The vulnerability is an integer overflow in the expat_realloc() function on 32‑bit architectures, causing the allocation size to wrap around. When malformed XML is processed, the resulting buffer is smaller than required, enabling a heap buffer overflow that corrupts adjacent memory, corrupts program state, or crashes the application.

The affected product is the libexpat library distributed by the libexpat Project. Versions 2.7.2 through 2.8.5, when compiled for 32‑bit platforms, are vulnerable. Any application that links against these versions or embeds the vulnerable code during XML parsing may be impacted.

The CVSS base score of 8.2 classifies the flaw as high severity. EPSS is unavailable, but the high CVSS score indicates significant risk. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely documented exploitation yet. Attackers supplying crafted XML to a process that parses it via libexpat can trigger the overflow, potentially causing a denial of service or memory corruption. The attack vector is local to the parsing process but can be remote if the XML originates from a network source.