Executive brief
Expat, a widely-used XML parser, fails to properly validate UTF-16 encoded text, allowing attackers to craft malformed XML sequences that hide markup characters from the parser. An attacker can exploit this to inject arbitrary XML content that bypasses validation checks, potentially leading to data injection, privilege escalation, or other attacks in applications that parse untrusted XML.
Technical details
The vulnerability exists in Expat's UTF-16 input handling, where the parser does not validate that low surrogates properly follow high surrogates. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters and enabling XML injection. The flaw is in the parser's surrogate pair validation logic during UTF-16 decoding.
Affected products
- libexpat Expat through 2.8.4
Timeline
- 2026-09-19: disclosed