libexpat versions from 2.7.2 through 2.9.0 contain a flaw where the XML_ParserReset function zeroes the direct byte counter but fails to adjust offsets that track heap allocations. When an attacker feeds a very large XML document, subsequent parse operations on the same reset parser later fail with XML_ERROR_NO_MEMORY, effectively preventing further processing and causing a service interruption.

The vulnerability affects the libexpat library, specifically the open‑source libexpat project. All installations of the library between release 2.7.2 and 2.9.0 are impacted, regardless of the host operating system or application using the library.

With a CVSS score of 8.2 the flaw is considered high severity. The EPSS score is <1% (approximately 0.00474) and it is not listed in CISA’s KEV catalog. An attacker who can deliver a large XML document to an application that uses a persistent libexpat parser can trigger the denial of service by exhausting memory during a subsequent parse. The likely attack vector is remote or local depending on how the vulnerable application accepts XML input. Once triggered, the parser will consistently return XML_ERROR_NO_MEMORY until the parser is completely recreated.