Technical impact
The issue is a heap‑based buffer overflow inside the doProlog function of libexpat's XML parser caused by mishandled reallocation of a backing array when data‑structure sharing occurs across parsers. The overflow can corrupt adjacent heap memory, potentially allowing an attacker to achieve arbitrary code execution or a denial‑of‑service if they can provide a malformed XML payload.
Affected Systems
The flaw exists in all libexpat releases older than 2.8.2. Any application that links against these versions may be vulnerable if it parses XML data. The precise impact on end systems depends on how the vulnerable library is used within those applications.
Risk and Exploitability
The CVSS score of 6.9 indicates a medium severity impact. The EPSS score of < 1% (0.00088) suggests a low probability of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply crafted XML to a vulnerable application; it is inferred that exploitation requires that untrusted XML reaches the vulnerable code path. Successful exploitation could corrupt the heap, potentially leading to arbitrary code execution or a denial‑of‑service.
Debian DLA
Debian DSA