The vulnerability resides in libexpat, where the function XML_ExternalEntityParserCreate fails to copy user data for unknown encoding handlers, leading to a null pointer dereference. This flaw can cause an application to crash when processing XML input that specifies an unfamiliar encoding, resulting in a denial of service. The weakness is classified as CWE‑476, a null pointer dereference.

All installations of the libexpat library older than version 2.7.4 are potentially affected. Applications that embed libexpat and invoke XML_ExternalEntityParserCreate—such as web servers, document processors, or other XML‑handling software—are at risk if they are linked against an unpatched library.

The CVSS score of 2.9 indicates a low severity impact, and the EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. Attackers would need to supply crafted XML content to trigger the crash, so an attacker must have the ability to influence input to the vulnerable parser.