The issue is a heap‑based buffer overflow inside the doProlog function of libexpat's XML parser caused by mishandled reallocation of a backing array when data‑structure sharing occurs across parsers. The overflow can corrupt adjacent heap memory, potentially allowing an attacker to achieve arbitrary code execution or a denial‑of‑service if they can provide a malformed XML payload.

The flaw exists in all libexpat releases older than 2.8.2. Any application that links against these versions may be vulnerable if it parses XML data. The precise impact on end systems depends on how the vulnerable library is used within those applications.

The CVSS score of 6.9 indicates a medium severity impact. No EPSS score is available, so current exploitation prevalence is unknown. This vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply crafted XML to a vulnerable application; it is inferred that exploitation requires that untrusted XML reaches the vulnerable code path. Successful exploitation could corrupt the heap, potentially leading to arbitrary code execution or a denial‑of‑service.