The vulnerability is a NULL pointer dereference in libexpat’s externalEntityInitProcessor2() that mishandles the XML_TOK_NONE token for empty input streams. When an attacker can control the chunking of XML data, they can force the parser to perform an empty, non‑final initial parse on an external entity subparser, causing a subsequent parse to dereference a NULL pointer and crash the application. This crash results in a denial‑of‑service to the affected process.

Affected vendors and products include the libexpat library. All releases of libexpat up to and including version 2.9.0 are impacted. Systems that parse XML streams containing external entities with these versions are susceptible to the flaw.

The CVSS score of 8.2 indicates high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be able to provide crafted XML data to the vulnerable parser, making the likely attack vector client‑side or application‑side. The risk remains significant in environments where external entities are processed and no other mitigations are in place.