Libexpat 2.10.0 and earlier contain an out-of-bounds read vulnerability (CWE-126) in the unknown_toUtf8() and unknown_toUtf16() functions within xmltok.c, triggered when processing application-registered unknown encodings. An attacker can supply an XML document that ends with a truncated multibyte sequence; the conversion callback then reads past the bounds of the parse buffer, potentially leaking adjacent memory contents or causing the host application to crash.

The affected products are libexpat from the libexpat project, specifically versions 2.10.0 and any earlier releases.

The CVSS score of 6.3 indicates medium severity, and no EPSS score is available, suggesting a low to moderate exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. An exploit can be achieved by feeding malicious XML input that contains a truncated multibyte sequence for an application-registered unknown encoding; the out-of-bounds read can reveal memory data or deny service. Given that libexpat is used to parse XML from potentially untrusted sources, remote exploitation is feasible if the library is exposed to external data. Overall risk is moderate, with the primary impact being memory disclosure or crash, and mitigation through patching is strongly advised.