For readers new to Expat:

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

Expat 2.8.5 was released a few hours ago. The key motivation for cutting a release and doing so now was to get the fix for vulnerability CVE-2026-93990 into the hands of the users.

The vulnerability was reported and fixed by Kartik Kenchi — thank you! Expat prior to release 2.8.5 did not stop attackers from smuggling malformed UTF-16 into the application using Expat, where it could cause arbitrary damage, depending on how malformed UTF-16 was handled inside the application. The issue was that surrogate pairs were not validated for the second half being a "low surrogate" in the range of 0xDC00 to 0xDFFF.

As usual, there is also non-security work that went into this release: bugfixes and improvements to the xmlwf command line utility, improvements to the two build systems, the documentation, the infrastructure, and also internals. For more details about this release, please check out the change log.

It should be noted that it was the Open Source Sabbatical of the City of Munich that allowed me to focus on libexpat for this release through its funding — thank you! We're in the second month of hopefully six months total; there continues to be plenty to do. Wish me luck!

Thanks to everyone who contributed to this release of Expat!

If you maintain Expat packaging, a bundled copy of Expat, or a pinned version of Expat, please update to version 2.8.5. Thank you!

Sebastian Pipping