A flaw in libexpat’s doContent function allows an integer overflow during tag buffer reallocation, which can expose internal memory contents or corrupt data. The weakness stems from the lack of a bounds check when determining the buffer size, and it is classified as a CWE-190 overflow.

The vulnerability affects the libexpat project’s libexpat library on any version prior to 2.7.4. Applications that embed or link against these older releases may be impacted.

The CVSS base score of 6.9 indicates medium severity. An EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could craft malicious XML input that triggers the overflow during buffer reallocation when processed by libexpat, potentially leading to information disclosure or data corruption. The attack could originate either locally or remotely, depending on where the XML is accepted.