The vulnerability arises when libexpat processes Unicode strings; low surrogate values are incorrectly treated as high surrogates during conversion in the *_toUtf16 functions. This misclassification triggers an out-of-bounds read and can result in an infinite loop, consuming CPU resources and exhausting service availability. The flaw is classified as CWE-125: Out‑of‑Bounds Read, and it mainly threatens system availability rather than confidentiality or integrity.

All installations of the libexpat library prior to version 2.8.3 are affected. The issue is present in the core libexpat project and impacts any application or service that relies on this library for XML parsing or Unicode conversion, regardless of platform.

With a CVSS score of 6.2, the vulnerability presents a moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that exploitation may be uncommon but not impossible. Attackers need to supply XML data containing low surrogate code points; such data could be delivered locally or over a network if the target application accepts untrusted XML. Once the malformed data is processed, the library enters an infinite loop, potentially exhausting CPU and causing a denial of service. No remote code execution or data exfiltration is possible, but the resulting service disruption can be critical in production environments.