A critical vulnerability in the libexpat library allows unauthenticated attackers to perform XML injection attacks by exploiting improper handling of UTF-16 surrogate sequences.

This vulnerability is caused by improper handling of Unicode encoding (CWE-176) where the parser fails to validate low surrogates following high surrogates. An unauthenticated attacker can supply crafted UTF-16 XML, which hides malicious markup from the parser and leads to successful XML injection.

The ability to perform XML injection poses a significant risk to data integrity and application logic. Successful exploitation may allow an attacker to bypass security filters, manipulate backend processing, or alter the intended structure of XML documents, which could lead to unauthorized actions or data exfiltration. Given the CVSS score of 7.5, this represents a high-severity risk that demands prompt attention to prevent potential service compromise.

Immediate Action: Monitor the official libexpat GitHub repository for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Review application logs for anomalous XML structures or unexpected input patterns that deviate from standard encoding practices.

Compensating Controls: Implement strict input validation at the application layer to reject malformed UTF-16 sequences before they reach the XML parser, or deploy a Web Application Firewall configured to detect and block suspicious XML injection attempts.

Public Exploit Available: No (As of September 20, 2026, there is no confirmed public exploit or weaponized code for this vulnerability.)

Organizations relying on libexpat should prioritize the identification of affected instances within their environment. While a specific patch is currently pending, security teams must prepare for immediate deployment once the fix is released. Ensuring that input sanitization is handled robustly at the application level will serve as a vital temporary measure to mitigate the risk of XML injection until the library can be updated.