This vulnerability is an integer overflow occurring in the storeAtts function within the libexpat XML parsing library. The overflow can cause incorrect calculation of internal buffer sizes, leading to potential memory corruption or abrupt termination of the parsing process. As a result, applications using the affected library may crash, suffer loss of availability, or, in a worst‑case scenario, lose data integrity. The weakness is identified as CWE‑190. The description does not explicitly confirm arbitrary code execution, so any such outcome would be speculative.

The affected product is libexpat, the XML parsing library from the libexpat project. Versions prior to 2.8.2 are impacted, as the description lists 2.8.2 as the first unaffected release. Any software that links against libexpat by version 2.8.1 or older on systems where XML input is parsed is potentially vulnerable.

The CVSS score of 6.9 indicates moderate overall risk. Because the EPSS score is not available, the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying that no publicly documented exploit is known. The likely attack vector, inferred from the nature of the flaw, is through crafted XML input delivered to any service or application that parses XML with libexpat. An attacker who supplies maliciously constructed attribute data could trigger the overflow during parsing, potentially causing a crash or memory corruption. The impact is predominantly denial of service and memory corruption; any code‑execution possibility is not proven in the description.