Description

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-19T23:17:10.203Z",
  "pubdate": "2026-09-19T23:17:10.203Z",
  "executiveSummary": "Expat versions through 2.8.4 exhibit a critical vulnerability related to improper input validation of UTF-16 character sequences. The parser fails to correctly validate low surrogates following high surrogates, permitting the processing of malformed UTF-16 data. This flaw leads to an XML injection vulnerability where attackers can craft malicious UTF-16 payloads to mask markup characters from the parser's validation logic.\nThe vulnerability allows an attacker to manipulate the interpretation of XML structures by embedding lone high surrogates that consume subsequent code units. This behavior effectively hides sensitive control characters or markup tags from security filters, potentially enabling unauthorized data injection or alteration of the document structure. The risk is significant for applications relying on Expat to process untrusted XML input, as the parser's inability to maintain state consistency during surrogate handling subverts established security boundaries. No specific authentication is required for exploitation if the attacker can submit arbitrary XML content to the target application, making this a high-impact vector for data integrity compromise and potential cross-site scripting or remote code injection depending on the host environment's processing context.",
  "technicalDetails": "The root cause of this vulnerability lies in the state machine responsible for UTF-16 decoding within the Expat library. UTF-16 encoding represents characters outside the Basic Multilingual Plane (BMP) using surrogate pairs: a high surrogate (U+D800 to U+DBFF) followed by a low surrogate (U+DC00 to U+DFFF). Expat versions through 2.8.4 do not adequately enforce the requirement that a high surrogate must be followed by a valid low surrogate. Instead, the parser allows a lone high surrogate to consume the subsequent 16-bit code unit, regardless of whether that code unit forms a valid surrogate pair.\nThis behavior introduces an XML injection vector through the desynchronization of the parser's tokenization process. By providing a malicious UTF-16 sequence, an attacker can cause the parser to 'swallow' characters that would normally be treated as XML markup (such as '<', '>', or '&'). By strategically placing these surrogate sequences, an attacker can hide malicious tags or attributes from security validation routines that examine the XML structure prior to full parsing.\nThe exploitation flow proceeds as follows: First, the attacker identifies an injection point in an application utilizing Expat to parse incoming XML documents. Second, the attacker crafts an XML payload where sensitive control characters are preceded or partially obscured by a malformed high surrogate. Third, when Expat processes this stream, it misinterprets the surrogate sequence and skips the subsequent bytes as part of the surrogate pair logic, effectively neutralizing the parser's ability to identify the injected control character.\nBecause the parser fails to return an error for the malformed sequence, the injected content is parsed as legitimate XML structure rather than literal text. This bypass allows the attacker to terminate existing elements prematurely, inject new unauthorized elements, or modify attribute values. This could lead to a variety of downstream impacts, including Cross-Site Scripting (XSS) if the XML is rendered in a browser, or arbitrary logic execution if the injected XML influences application behavior in a server-side context. The vulnerability is persistent across all platforms that rely on the affected Expat versions to decode UTF-16 encoded XML, and because the flaw is inherent to the parsing logic, it does not require administrative privileges or network-level access, only the ability to supply the malformed XML payload."
}