The libexpat XML parser before version 2.8.2 does not maintain proper depth tracking for handler‑invoked calls when a policy violation occurs, allowing a use‑after‑free vulnerability. This flaw is classified as CWE‑416 and can corrupt memory, potentially enabling code execution or other compromise, as reflected in its CVSS score of 4.9.

The vulnerability affects the libexpat project’s XML parsing library in all releases older than 2.8.2. Executables or services that link against these versions and parse XML from untrusted sources are potentially exposed to the flaw.

With a moderate CVSS score and no EPSS data, the likelihood of exploitation is uncertain, though the vulnerability is not yet listed in the CISA KEV catalog. The most likely attack vector involves an attacker delivering a crafted XML document that triggers the erroneous handler calls within the parser, leading to a use‑after‑free condition.