The vulnerability resides in libexpat versions up to 2.9.0 and is triggered when the xmlparse.c routine accountingDiffTolerated scans XML input. The detection of the billion‐laughs attack is performed too late, allowing an attacker to supply a moderately sized document that contains a large DTD and deeply nested entities. Parsing such a document consumes tens of seconds of CPU time, effectively blocking legitimate use of the library and causing a denial of service. The weakness is a resource exhaustion flaw (CWE‑776).

All software that includes libexpat before version 2.9.1 is affected, as the issue exists in the libexpat library itself. Systems that rely on the library to parse XML from untrusted sources—such as web servers, applications that handle XML feeds, or any component that performs XML validation—are vulnerable.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. Although an EPSS score is not available and the issue is not listed in the CISA KEV catalog, the attack surface is wide because any XML input can be used. The likely attack vector is through user‑supplied XML data; a remote or local attacker could send a crafted file or message that forces the library to exhaust CPU resources during parsing. The exploitation is straightforward and requires only the ability to feed the vulnerable parser a crafted XML document.