The vulnerability is a quadratic algorithmic complexity flaw in the storeAtts() function of xmlparse.c within libexpat. When an attacker supplies a XML document containing N attributes with non‑normalized values, the parser performs an O(N²) scan of elementType->defaultAtts to determine CDATA status, leading to excessive CPU consumption. The effect is a denial of service on the host running the XML parser. The flaw does not require authentication, external entity resolution, or special parser options. Its primary consequence is availability degradation through uncontrolled resource usage.

The issue affects the libexpat project’s libexpat library up to and including version 2.8.3. Any application that links against or uses libexpat for XML parsing of untrusted input is potentially vulnerable.

The CVSS score of 8.7 classifies this vulnerability as high severity. Although the EPSS score is not available and it is not listed in the CISA KEV catalog, the attack vector is remote and does not require authentication, implying that malicious actors can initiate the exploit by sending a crafted XML file to the target application over the network. The implementation complexity is low, making the exploit likely to be readily achievable once the symbolic vector is known.