Red Hat Security Advisory

RHSA-2026:71655

Red Hat Hardened Images RPMs Security Update

Released 2026-09-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images expat-2.8.4-0.2.hum1@aarch64, expat-2.8.4-0.2.hum1@src, expat-2.8.4-0.2.hum1@x86_64 +4

Fixes 1 record

TI-2026-63249 CVE-2026-93990 · GHSA-rfp9-ffqc-h4x8

Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

MEDIUM 44

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00403 Published 2026-09-19 Partial fix · 2.8.5 CWE-176