In libexpat, prior to version 2.8.2, the library does not track handler call depth when XML_ResumeParser is invoked inside XML handlers after a policy violation. When a handler calls XML_ResumeParser, the internal parser context may reference freed memory, giving rise to a use‑after‑free condition. An attacker who can supply crafted XML that triggers a policy violation and then causes the parser to resume is able to corrupt memory, potentially leading to arbitrary code execution.

The vulnerability affects libexpat, the XML parsing library developed by the libexpat project, on all releases older than 2.8.2. No specific distribution masks are identified; any system that links against an affected libexpat binary is at risk.

The CVSS score of 4.9 indicates a moderate vulnerability. No EPSS score is available and the issue is not listed in CISA KEV, suggesting that a public exploit has not yet been documented. The implied attack vector is local or remote XML processing—any environment that feeds untrusted XML to the vulnerable library could be used by an attacker to trigger the use-after-free. While exploitation is not guaranteed, the potential for memory corruption and code execution warrants timely remediation.