Hi,

The following vulnerability was published for expat.

CVE-2026-93990[0]:
| Expat through 2.8.4 fails to validate low surrogates following high
| surrogates in UTF-16 input, allowing malformed UTF-16 sequences to
| be accepted. Attackers can craft UTF-16 encoded XML with lone high
| surrogates that consume following code units, hiding markup
| characters from the parser and enabling XML injection attacks.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93990
https://www.cve.org/CVERecord?id=CVE-2026-93990
[1] https://github.com/libexpat/libexpat/pull/1282
[2] https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091
[3] https://github.com/libexpat/libexpat/commit/28fcfba540f6933aa8904a1514c4811713d2ab72

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148665@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated expat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 22 Sep 2026 06:48:48 +0200
Source: expat
Architecture: source
Version: 2.8.4-2
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Closes: 1148665
Changes:
 expat (2.8.4-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-93990: fails to validate low
     surrogates following high surrogates in UTF-16 input (closes: #1148665).
Checksums-Sha1:
 23aace7fbbc305b892865f21e965e18f1cc1bbbd 1970 expat_2.8.4-2.dsc
 71217daa8963fd4ec3d556d9cf911b403372fdda 17272 expat_2.8.4-2.debian.tar.xz
Checksums-Sha256:
 85085c8874a3f9af59abd9d61d83a1f125e243d2209fd8156ad00fdf288c34d1 1970 expat_2.8.4-2.dsc
 558110a1a2dab94b0807647d3f6a89f00c05ddb80f69a0b2c62a12cb385f44d8 17272 expat_2.8.4-2.debian.tar.xz
Files:
 dc7b14ea20b57c7de16d28831cb579e8 1970 text optional expat_2.8.4-2.dsc
 1432163a03e729254f9f0c2a9783f595 17272 text optional expat_2.8.4-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmqyCxEACgkQ3OMQ54ZM
yL+gAw//XGekjmgg+NuDW8ajnQgHO+PR3N+yC0iz0sYW+BtnxXx7maxb7sXdM+Q5
ddsUzHW39GA7Hh1KClDyLEc1mRBZwWe9wCyAbX5w6Vms98pZ3qw4JgCFysSZ1cAo
QdLi0e1TvsQxICDudSF6bv/U9eG8Zv34ylHZX1CwPs7twCPIgEBUepJ9U1Etlj7b
lMv+6hPafiIvVDzTNZUOyktOFuRAKe1e7ys0SeD3LTneATqkkBQ/bLESRZcYYobA
5Ya7yHgLKYTmxtiyELXBC/aRrhGrbaPekpSpQq8DhK78qIpY7e5tf+imK8+jnHeS
C57oxRVghAXH8w/3pugD2BWt9kzzykIMdzYbLafOavGZROK76fhJUgQMESSRoVO7
QVY7lm4BCo9DRE6qWdjCChEh3SZrBCKzPCMlfyH2DaqbO4qLTym31b3Ifyn/B4kz
bHRA2oVGq7No4bh6qrKaNtwRv5AYx82zvnEZ0R2v0Vn8LqL1+lcQdSqw9SEDcLfd
RJlf97yPB10vk5+9910TEiq7yAuSuNZCKR2fjTOIlryp5JrAJJu2LJ3zbmkTyjlW
6Xo2MWHbJlECcwmaBuVQe7cLUwNWFE71V9UBJGORfwYkOs82mf52CB76Z0DoE5Dx
m2Uxu1axY7+d5DcFVAjngydgCXyE04IdEQioYwfq/ixGjEOYhW4=
=GcEs
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148665@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated expat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 11 Oct 2026 15:25:11 +0200
Source: expat
Architecture: source
Version: 2.9.0-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1148665 1149507
Changes:
 expat (2.9.0-1~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for trixie-security
 .
 expat (2.9.0-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-77214: validate parameter len against available buffer
       capacity in XML_ParseBuffer(),
     - fixes CVE-2026-102633: integer overflow in function expat_realloc()
       on 32bit platforms.
   * Update libexpat1 symbols.
 .
 expat (2.8.5-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-102633: replace assert with runtime
     overflow check in expat_realloc (closes: #1149507).
 .
 expat (2.8.5-1) unstable; urgency=medium
 .
   * New upstream release.
 .
 expat (2.8.4-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-93990: fails to validate low
     surrogates following high surrogates in UTF-16 input (closes: #1148665).
 .
 expat (2.8.4-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
       "attribute isCdata lookups" that allowed denial of service attacks,
     - fixes CVE-2026-76957: protect custom encoding callbacks from parser
       re-entry,
     - fixes CVE-2026-76956: fix inverted getentropy() return handling.
Checksums-Sha1:
 941b0a4b27d13c82ba355981912b42236503bfd0 2157 expat_2.9.0-1~deb13u1.dsc
 757c277106dfab05e1ad895d31ed63c82b438c04 8488503 expat_2.9.0.orig.tar.gz
 b7fc0d435cc0ca3f0ab63ccd687848e4f6ebcf77 14348 expat_2.9.0-1~deb13u1.debian.tar.xz
 1e540318bfeb63b90ed5c2ef5591167e66527f88 5269 expat_2.9.0-1~deb13u1_source.buildinfo
Checksums-Sha256:
 09fe168e2186a2672e077d9fda02287b51fa08f73914fcc425b3307b503df8ff 2157 expat_2.9.0-1~deb13u1.dsc
 6e8ce7b52ebbaa423c59becc7cf1e6875c42e49228c062ac8123c10e700cec27 8488503 expat_2.9.0.orig.tar.gz
 0c1575a3dc3d039f9e6751821efcdfd5246e04c6af4939defa01226d94541fba 14348 expat_2.9.0-1~deb13u1.debian.tar.xz
 557af304e95c3ed8a494c4d843397ca4b6afcdfd3e0bb55b322404a4f71f7c02 5269 expat_2.9.0-1~deb13u1_source.buildinfo
Files:
 8b93d6a8e28ab8fa25b0df2de5e6f792 2157 text optional expat_2.9.0-1~deb13u1.dsc
 a33aef07840ad21397f99299e43b033a 8488503 text optional expat_2.9.0.orig.tar.gz
 2f0a17ecfd0a8acbc5a4fd47052b81b3 14348 text optional expat_2.9.0-1~deb13u1.debian.tar.xz
 c2e7798c92da7f5cee94f0e19d52ee90 5269 text optional expat_2.9.0-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrNTBVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EL1cP/3xzGnnYB6bX2TqTrD4p5nK8QGBr5Xhf
Qdoat7+GnLLYWNKVmfh+EV6kBqd3RpTwbEHYqnh0RW34rvGEGQMZe2douJmD5lG7
NyRa0QNFzU65p0KGLPNWFR9eRBS2mIR5wAAvcroP2lgmBfyo3cd8QzsrEXUUjF3+
2cD2/98qroE4g6CWWD27V/9Y8zOP4t8k7/2QM5er21h5eDiBg/+YKy23gvMfM7xM
0uFbiDfRzhTZsrofjh/02u+ELi4KZVNtFXLKf4D+vqP52D5NNDV5jDXRfT41B3jK
jltuHuYLEXROW/OpZEsbYE9KTAAzi7gdymdj+3KViJbYd7pMimyN84o3nXuy2Fte
JsqEcsDnqWb60EdcE0muUtcqmRtwv1j0gcfvrKfv5/nT73PVrdlcVfEWJxznZXJ1
oLz95AT0NIK/+wBj01IgAGKeI/3dPOnZ00Kt3yz8VWNRfCntJEMf1ONpHBKrgMlu
VoXz41jr88nhEopQPffebdVuSt06/witz/SxFgvatkSG1Oxg+1aEGe2EGdq9t5vz
lHp7yhqNMbwypMr7nhhm/iH6eEjojlzkigbgNED2Lk6GKYk6mY40tC4/4xgFksHm
CwwpGDe8chgSGf7NcfMljv7Nzl4Nk3Cdx1H4eiol3KcTZP+hjE7pcdFHfXuRmiIU
gaPrz5fj/FK/
=HA4W
-----END PGP SIGNATURE-----