The vulnerability is a stack‑based buffer overflow in libnxml’s parsing routine. Remote attackers can supply XML or RSS feeds that contain element, attribute, DOCTYPE, or entity names up to 1,022 characters long, ending in a multi‑byte UTF‑8 character. When processed, the parser writes past its 1,024‑byte stack buffer, causing the application to crash. The flaw carries a CVSS score of 8.7 and results in a denial of service.

Bakulf’s libnxml library releases prior to 0.18.6 are affected. Any software that links to these older versions and processes XML or RSS input is vulnerable. The issue was resolved in release 0.18.6 and later.

Exploitation requires a remote attacker to deliver a crafted XML or RSS payload to the vulnerable application. The attack vector is remote via network or file input, and the exploit path is straightforward once the payload is supplied. With a high CVSS score, the vulnerability poses a significant risk; however, its EPSS score is currently unknown and it is not listed in CISA KEV. Organizations should consider it a high‑risk security issue that can be triggered by ordinary external XML input.