libexpat before 2.7.5 can dereference a NULL pointer when parsing XML documents that contain an empty external parameter entity. This dereference causes the library, and therefore the calling application, to crash, resulting in a denial of service for that service. The vulnerability can be exploited by supplying a crafted XML payload to any process that uses the affected libexpat version.

The affected vendor is the libexpat project. All builds of libexpat prior to version 2.7.5 contain the vulnerability. Any operating system or application that ships a pre‑2.7.5 copy of libexpat or links against it could be impacted.

The CVSS score is 4, indicating low to medium severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the ability to supply crafted XML; if the library is used by a network‑exposed service, remote attackers could trigger the crash, otherwise local attackers can exploit local processes that parse XML.