A signed integer overflow in the XML parsing routine of libexpat can be triggered by a malformed start tag containing an astronomical number of attributes. The overflow corrupts the internal attribute index and the prefix counter, which can lead to out-of-bounds memory writes, heap corruption, crashes, and in certain contexts, arbitrary code execution.

The vulnerability affects all instances of the libexpat library up to and including version 2.9.0. Any application or service that incorporates libexpat—such as web servers, XML‐handling utilities, or other software that parses XML documents—runs the risk if it links against a vulnerable release. The affected library is identified in the CPE as libexpat_project:libexpat and is widely used on numerous operating systems and platforms.

The CVSS score of 8.2 indicates a high severity exploit potential. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue, implying that there is no public evidence of widespread exploitation yet. The attack requires an attacker to supply an XML document with a start tag containing more than a billion attributes, which may be feasible over a network or local interface if the parsing endpoint accepts arbitrary input. When delivered, the vulnerability can cause a denial of service by crashing the host process, corrupt heap memory, and potentially allow control flow hijack if the attacker can influence or predict the corrupted data.