The library creates a denial‑of‑service condition when processing a file that is roughly 2 MiB in size, causing the parser to consume dozens of seconds of CPU time. The weakness is classified as CWE‑407. Based on the description, it is inferred that attackers can trigger this cost‑heavy parsing by submitting a specifically‑crafted document to any process that loads libexpat for XML processing.

The issue affects libexpat in all releases through 2.7.3 distributed by the libexpat project. Systems that use this library – for example application servers, command‑line tools, and embedded controllers – are vulnerable if they compile or link against these versions. No later versions are affected, and the problem is resolved in the 2.7.4 release.

The CVSS score of 2.9 reflects a low overall severity, and the EPSS score of less than 1% indicates a very small probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited current exploitation. The remediation path requires an attacker to provide the offending file to the parsing component, so this attack is most feasible in a local or remote context where an application accepts untrusted input. A well‑timed large input can disrupt service availability, but it does not allow code execution or data exfiltration.