Coin3: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. (CVE-2026-93990)
Severity: mediumType: VulnerabilityCVE-2026-93990
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
EPSS 0.5%top 62%
Coin3: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. (CVE-2026-93990)
0
MediumVulnerabilityCVE-2026-93990gcveosvubuntu-cve-2026-93990cve-2026-93990ubuntu-pro-14-04-ltsubuntu-pro-16-04-ltsubuntu-16-04-ltsubuntu-pro-18-04-ltsubuntu-18-04-ltsubuntu-pro-20-04-ltsubuntu-20-04-ltsubuntu-22-04-ltsubuntu-pro-22-04-ltsubuntu-24-04-ltsubuntu-pro-24-04-ltsubuntu-26-04-ltsubuntu-pro-26-04-lts
Published: 09/19/2026 (09/19/2026, 23:17:00 UTC)
Source: GCVE Database
Product: coin3
Description
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
CVSS v3.1
Score 7.5high
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected software
coin3
pkg:deb/ubuntu/coin3?arch=source&distro=esm-infra-legacy/trustyAffected versions
=3.1.4~abc9f50-3=3.1.4~abc9f50-4=3.1.4~abc9f50-4ubuntu2=3.1.4~abc9f50-4ubuntu2+esm1=3.1.4~abc9f50-4ubuntu2+esm2
expat
pkg:deb/ubuntu/expat?arch=source&distro=esm-infra-legacy/trustyAffected versions
=2.1.0-4=2.1.0-4ubuntu1=2.1.0-4ubuntu1.1=2.1.0-4ubuntu1.2=2.1.0-4ubuntu1.3=2.1.0-4ubuntu1.4=2.1.0-4ubuntu1.4+esm1=2.1.0-4ubuntu1.4+esm2=2.1.0-4ubuntu1.4+esm4=2.1.0-4ubuntu1.4+esm6=2.1.0-4ubuntu1.4+esm7=2.1.0-4ubuntu1.4+esm8=2.1.0-4ubuntu1.4+esm9=2.1.0-4ubuntu1.4+esm10=2.1.0-4ubuntu1.4+esm11=2.1.0-4ubuntu1.4+esm12
vnc4
pkg:deb/ubuntu/vnc4?arch=source&distro=esm-infra-legacy/trustyAffected versions
=4.1.1+xorg4.3.0-37ubuntu5=4.1.1+xorg4.3.0-37ubuntu5.0.1=4.1.1+xorg4.3.0-37ubuntu5.0.2=4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
vtk
pkg:deb/ubuntu/vtk?arch=source&distro=esm-infra-legacy/trustyAffected versions
=5.8.0-14ubuntu1=5.8.0-14ubuntu3=5.8.0-14.1ubuntu2=5.8.0-14.1ubuntu3=5.8.0-14.1ubuntu3+esm1
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=esm-infra-legacy/trustyAffected versions
=1.16.33-3.2ubuntu3=1.33.06-0ubuntu1=1.33.06-0ubuntu1+esm1
expat
pkg:deb/ubuntu/expat?arch=source&distro=esm-infra-legacy/xenialAffected versions
=2.1.0-7=2.1.0-7ubuntu0.16.04.1=2.1.0-7ubuntu0.16.04.2=2.1.0-7ubuntu0.16.04.3=2.1.0-7ubuntu0.16.04.4=2.1.0-7ubuntu0.16.04.5=2.1.0-7ubuntu0.16.04.5+esm2=2.1.0-7ubuntu0.16.04.5+esm5=2.1.0-7ubuntu0.16.04.5+esm6=2.1.0-7ubuntu0.16.04.5+esm7=2.1.0-7ubuntu0.16.04.5+esm8=2.1.0-7ubuntu0.16.04.5+esm9=2.1.0-7ubuntu0.16.04.5+esm10=2.1.0-7ubuntu0.16.04.5+esm11=2.1.0-7ubuntu0.16.04.5+esm12=2.1.0-7ubuntu0.16.04.5+esm13
ayttm
pkg:deb/ubuntu/ayttm?arch=source&distro=esm-apps-legacy/xenialAffected versions
=0.6.3-3build1=0.6.3-3ubuntu0.1~esm1
cableswig
pkg:deb/ubuntu/cableswig?arch=source&distro=esm-apps-legacy/xenialAffected versions
=0.1.0+git20150808-1=0.1.0+git20150808-2=0.1.0+git20150808-2ubuntu0.1~esm1
cadaver
pkg:deb/ubuntu/cadaver?arch=source&distro=xenialAffected versions
=0.23.3-2ubuntu2
coin3
pkg:deb/ubuntu/coin3?arch=source&distro=esm-apps/xenialAffected versions
=3.1.4~abc9f50+dfsg1-1=3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1=3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
gdcm
pkg:deb/ubuntu/gdcm?arch=source&distro=xenialAffected versions
=2.4.4-4=2.4.4-4build1=2.4.4-4ubuntu1=2.6.1-3=2.6.2-1=2.6.2-2=2.6.2-3=2.6.3-1=2.6.3-1ubuntu1=2.6.3-2ubuntu1=2.6.3-3ubuntu1=2.6.3-3ubuntu3
insighttoolkit4
pkg:deb/ubuntu/insighttoolkit4?arch=source&distro=xenialAffected versions
=4.8.1-1ubuntu3=4.8.1-1ubuntu4=4.8.2-3.1ubuntu1=4.9.0-3ubuntu2=4.9.0-4ubuntu1=4.9.0-4ubuntu1.1
libxmltok
pkg:deb/ubuntu/libxmltok?arch=source&distro=esm-apps/xenialAffected versions
=1.2-3build3=1.2-3ubuntu0.16.04.1~esm1=1.2-3ubuntu0.16.04.1~esm2=1.2-3ubuntu0.16.04.1~esm3=1.2-3ubuntu0.16.04.1~esm4=1.2-3ubuntu0.16.04.1~esm5
matanza
pkg:deb/ubuntu/matanza?arch=source&distro=xenialAffected versions
=0.13+ds1-5
smart
pkg:deb/ubuntu/smart?arch=source&distro=xenialAffected versions
=1.4-2
swish-e
pkg:deb/ubuntu/swish-e?arch=source&distro=esm-apps/xenialAffected versions
=2.4.7-4=2.4.7-4build1=2.4.7-4ubuntu0.1~esm1
tdom
pkg:deb/ubuntu/tdom?arch=source&distro=xenialAffected versions
=0.8.3-1
vnc4
pkg:deb/ubuntu/vnc4?arch=source&distro=esm-apps/xenialAffected versions
=4.1.1+xorg4.3.0-37.3ubuntu2=4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
vtk
pkg:deb/ubuntu/vtk?arch=source&distro=esm-apps/xenialAffected versions
=5.10.1+dfsg-2=5.10.1+dfsg-2build3=5.10.1+dfsg-2.1build1=5.10.1+dfsg-2.1ubuntu0.1~esm1
wbxml2
pkg:deb/ubuntu/wbxml2?arch=source&distro=xenialAffected versions
=0.10.7-1
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=esm-apps-legacy/xenialAffected versions
=1.33.14-0.2ubuntu3=1.33.14-1ubuntu1=1.33.14-1ubuntu1+esm1
expat
pkg:deb/ubuntu/expat?arch=source&distro=esm-infra/bionicAffected versions
=2.2.3-1=2.2.3-2=2.2.5-0ubuntu2=2.2.5-3=2.2.5-3ubuntu0.1=2.2.5-3ubuntu0.2=2.2.5-3ubuntu0.4=2.2.5-3ubuntu0.7=2.2.5-3ubuntu0.8=2.2.5-3ubuntu0.9=2.2.5-3ubuntu0.9+esm1=2.2.5-3ubuntu0.9+esm2=2.2.5-3ubuntu0.9+esm3=2.2.5-3ubuntu0.9+esm4
cadaver
pkg:deb/ubuntu/cadaver?arch=source&distro=bionicAffected versions
=0.23.3-2ubuntu3
coin3
pkg:deb/ubuntu/coin3?arch=source&distro=esm-apps/bionicAffected versions
=3.1.4~abc9f50+dfsg1-2=3.1.4~abc9f50+dfsg2-1=3.1.4~abc9f50+dfsg3-1=3.1.4~abc9f50+dfsg3-2=3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
gdcm
pkg:deb/ubuntu/gdcm?arch=source&distro=bionicAffected versions
=2.8.2-3build1=2.8.3-1=2.8.4-1=2.8.4-1build2
insighttoolkit4
pkg:deb/ubuntu/insighttoolkit4?arch=source&distro=bionicAffected versions
=4.12.2-dfsg1-1ubuntu1
libxmltok
pkg:deb/ubuntu/libxmltok?arch=source&distro=esm-apps/bionicAffected versions
=1.2-4=1.2-4ubuntu0.18.04.1~esm1=1.2-4ubuntu0.18.04.1~esm2=1.2-4ubuntu0.18.04.1~esm3=1.2-4ubuntu0.18.04.1~esm4=1.2-4ubuntu0.18.04.1~esm5=1.2-4ubuntu0.18.04.1~esm6
matanza
pkg:deb/ubuntu/matanza?arch=source&distro=bionicAffected versions
=0.13+ds1-5build1=0.13+ds1-6
smart
pkg:deb/ubuntu/smart?arch=source&distro=bionicAffected versions
=1.4-2
swish-e
pkg:deb/ubuntu/swish-e?arch=source&distro=esm-apps/bionicAffected versions
=2.4.7-5ubuntu1=2.4.7-5ubuntu1+esm1
tdom
pkg:deb/ubuntu/tdom?arch=source&distro=bionicAffected versions
=0.8.3-1=0.9.0-1
vnc4
pkg:deb/ubuntu/vnc4?arch=source&distro=bionicAffected versions
=4.1.1+xorg4.3.0-37.3ubuntu2
wbxml2
pkg:deb/ubuntu/wbxml2?arch=source&distro=bionicAffected versions
=0.10.7-1=0.10.7-1build1
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=esm-apps/bionicAffected versions
=1.33.14-7=1.33.14-8=1.33.14-8build1=1.33.14-8ubuntu0.18.04.1~esm1
expat
pkg:deb/ubuntu/expat?arch=source&distro=esm-infra/focalAffected versions
=2.2.7-2=2.2.9-1=2.2.9-1build1=2.2.9-1ubuntu0.2=2.2.9-1ubuntu0.4=2.2.9-1ubuntu0.5=2.2.9-1ubuntu0.6=2.2.9-1ubuntu0.7=2.2.9-1ubuntu0.8=2.2.9-1ubuntu0.8+esm1=2.2.9-1ubuntu0.8+esm2
cadaver
pkg:deb/ubuntu/cadaver?arch=source&distro=focalAffected versions
=0.23.3-2.1build1
insighttoolkit4
pkg:deb/ubuntu/insighttoolkit4?arch=source&distro=focalAffected versions
=4.12.2-dfsg1-4.1ubuntu1=4.13.2-dfsg1-1ubuntu1=4.13.2-dfsg1-4ubuntu1=4.13.2-dfsg1-6=4.13.2-dfsg1-6ubuntu1=4.13.2-dfsg1-8
libxmltok
pkg:deb/ubuntu/libxmltok?arch=source&distro=esm-apps/focalAffected versions
=1.2-4=1.2-4ubuntu0.20.04.1~esm1=1.2-4ubuntu0.20.04.1~esm2=1.2-4ubuntu0.20.04.1~esm3=1.2-4ubuntu0.20.04.1~esm4=1.2-4ubuntu0.20.04.1~esm5=1.2-4ubuntu0.20.04.1~esm6
matanza
pkg:deb/ubuntu/matanza?arch=source&distro=focalAffected versions
=0.13+ds1-6=0.13+ds2-1
swish-e
pkg:deb/ubuntu/swish-e?arch=source&distro=esm-apps/focalAffected versions
=2.4.7-6build1=2.4.7-6build2=2.4.7-6ubuntu0.1~esm1
tdom
pkg:deb/ubuntu/tdom?arch=source&distro=focalAffected versions
=0.9.1-1
wbxml2
pkg:deb/ubuntu/wbxml2?arch=source&distro=focalAffected versions
=0.10.7-1build1
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=esm-apps/focalAffected versions
=1.33.14-8build1=1.33.14-8build2=1.33.14-8ubuntu0.20.04.1~esm1
cadaver
pkg:deb/ubuntu/cadaver?arch=source&distro=jammyAffected versions
=0.23.3-2.1build1
expat
pkg:deb/ubuntu/expat?arch=source&distro=jammyAffected versions
=2.4.1-2=2.4.1-3=2.4.2-1=2.4.3-1=2.4.3-2=2.4.4-1=2.4.6-1=2.4.7-1=2.4.7-1ubuntu0.1=2.4.7-1ubuntu0.2=2.4.7-1ubuntu0.3=2.4.7-1ubuntu0.4=2.4.7-1ubuntu0.5=2.4.7-1ubuntu0.6=2.4.7-1ubuntu0.7=2.4.7-1ubuntu0.8
insighttoolkit4
pkg:deb/ubuntu/insighttoolkit4?arch=source&distro=jammyAffected versions
=4.13.3withdata-dfsg1-4.1=4.13.3withdata-dfsg2-1ubuntu1
matanza
pkg:deb/ubuntu/matanza?arch=source&distro=jammyAffected versions
=0.13+ds2-1
tdom
pkg:deb/ubuntu/tdom?arch=source&distro=jammyAffected versions
=0.9.2-1
wbxml2
pkg:deb/ubuntu/wbxml2?arch=source&distro=jammyAffected versions
=0.10.7-1build1=0.11.7+dfsg-1
libxmltok
pkg:deb/ubuntu/libxmltok?arch=source&distro=esm-apps/jammyAffected versions
=1.2-4=1.2-4ubuntu0.22.04.1~esm1=1.2-4ubuntu0.22.04.1~esm2=1.2-4ubuntu0.22.04.1~esm3=1.2-4ubuntu0.22.04.1~esm4=1.2-4ubuntu0.22.04.1~esm5=1.2-4ubuntu0.22.04.1~esm6
swish-e
pkg:deb/ubuntu/swish-e?arch=source&distro=esm-apps/jammyAffected versions
=2.4.7-6build3=2.4.7-6.1=2.4.7-6.1build1=2.4.7-6.1ubuntu0.1~esm1
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=esm-apps/jammyAffected versions
=1.33.14-9=1.33.14-10=1.33.14-10ubuntu0.1~esm1
cadaver
pkg:deb/ubuntu/cadaver?arch=source&distro=nobleAffected versions
=0.24+dfsg-2=0.24+dfsg-3=0.24+dfsg-3build1=0.24+dfsg-3build2
expat
pkg:deb/ubuntu/expat?arch=source&distro=nobleAffected versions
=2.5.0-2=2.6.0-1=2.6.1-2=2.6.1-2build1=2.6.1-2ubuntu0.1=2.6.1-2ubuntu0.2=2.6.1-2ubuntu0.3=2.6.1-2ubuntu0.4=2.6.1-2ubuntu0.5
matanza
pkg:deb/ubuntu/matanza?arch=source&distro=nobleAffected versions
=0.13+ds2-1=0.13+ds2-1build1=0.13+ds2-1build2
tdom
pkg:deb/ubuntu/tdom?arch=source&distro=nobleAffected versions
=0.9.3-1=0.9.3-1build1
wbxml2
pkg:deb/ubuntu/wbxml2?arch=source&distro=nobleAffected versions
=0.11.8+dfsg-3=0.11.8+dfsg-3build1
libxmltok
pkg:deb/ubuntu/libxmltok?arch=source&distro=esm-apps/nobleAffected versions
=1.2-4ubuntu1=1.2-4.1ubuntu1=1.2-4.1ubuntu2=1.2-4.1ubuntu2.24.0.4.1+esm1=1.2-4.1ubuntu2.24.0.4.1+esm2=1.2-4.1ubuntu2.24.0.4.1+esm3=1.2-4.1ubuntu2.24.0.4.1+esm4
swish-e
pkg:deb/ubuntu/swish-e?arch=source&distro=esm-apps/nobleAffected versions
=2.4.7-6.2=2.4.7-6.2build1=2.4.7-6.2build2=2.4.7-6.2build3=2.4.7-6.2ubuntu0.1~esm1
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=esm-apps/nobleAffected versions
=1.33.14-11=1.33.14-11.1=1.33.14-12=1.33.14-12build1=1.33.14-12build2=1.33.14-12ubuntu0.1~esm1
cadaver
pkg:deb/ubuntu/cadaver?arch=source&distro=resoluteAffected versions
=0.26+dfsg-2=0.28+dfsg-1=0.28+dfsg-2
expat
pkg:deb/ubuntu/expat?arch=source&distro=resoluteAffected versions
=2.7.1-2=2.7.3-1=2.7.4-1=2.7.4-1ubuntu0.1
matanza
pkg:deb/ubuntu/matanza?arch=source&distro=resoluteAffected versions
=0.13+ds2-2=0.13+ds2-2build1
tdom
pkg:deb/ubuntu/tdom?arch=source&distro=resoluteAffected versions
=0.9.5.1-3=0.9.6-2
wbxml2
pkg:deb/ubuntu/wbxml2?arch=source&distro=resoluteAffected versions
=0.11.10+dfsg-2=0.11.10+dfsg-2build1=0.11.10+dfsg-3
xmlrpc-c
pkg:deb/ubuntu/xmlrpc-c?arch=source&distro=resoluteAffected versions
=1.59.03-10.1=1.60.05-1
swish-e
pkg:deb/ubuntu/swish-e?arch=source&distro=esm-apps/resoluteAffected versions
=2.4.7-7=2.4.7-7.1=2.4.7-7.1ubuntu0.1~esm1
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-93990
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.04:LTS","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ab4be27f7a7c54106eee996
Added to database: 09/24/2026, 06:07:35 UTC
Last updated: 09/25/2026, 01:47:46 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Sort by
Loading community insights…
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Please log in to the Console to use AI analysis features.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Breach by OffSeqOFFSEQFRIENDS — 25% OFF
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
OffSeq TrainingCredly Certified
Lead Pen Test Professional
Technical5-day eLearningPECB Accredited