The vulnerability exists in libexpat versions prior to 2.7.5. A NULL pointer dereference is triggered in the setContext function when retrying after an earlier out‑of‑memory condition. This leads to a crash of the process that uses the library, resulting in a denial of service. The weakness is a Null Pointer Dereference, CWE‑476.

The libexpat library from the libexpat project, in any application that links to it, is affected. All versions before 2.7.5 are vulnerable. This includes typical Linux distributions, embedded systems, and any third‑party software that bundles an older libexpat.

The CVSS score of 2.9 indicates low severity, and the EPSS score is below 1 %, meaning the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker or privileged user can supply a large XML document to trigger an out‑of‑memory condition and then cause the library to crash, leading to service interruption. Because it is a denial of service, it does not compromise confidentiality or integrity.