libexpat before version 2.8.2 contains an integer overflow in the getAttributeId function, which can corrupt memory for malformed XML input. The overflow may result in a crash or denial of service, and while the CVE description does not indicate remote code execution, the corruption could be leveraged by a local attacker to destabilize services.

The vulnerability affects the libexpat project’s libexpat library for all releases prior to 2.8.2. Any system using a pre‑2.8.2 build of this library is at risk.

With a CVSS score of 6.9, the risk is moderate. The EPSS score is not provided and the issue is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of assessment. Attackers would need to supply crafted XML data to trigger the overflow, typically through local or elevated code that parses XML files. The impact is primarily denial of service unless coupled with additional vulnerabilities.