Expat, the XML parser library used in many programs, contains an out‑of‑bounds read when handling external entities. The flaw occurs in the storeAtts function, where a struct size mismatch causes the attIndex member to be read beyond its allocated buffer. This can lead to memory corruption that may be exploited to trigger a segmentation fault or, in some cases, arbitrary code execution. The vulnerability is classified as CWE‑125.

All libexpat releases up to and including version 2.8.3 are affected. Clients that rely on libexpat without an update are vulnerable, regardless of the application they run. The bug was introduced by the fix for CVE‑2026‑66046 and remains present in any distribution containing that code.

With a CVSS score of 8.7 this flaw is considered high severity. No public exploits are currently known and the EPSS score is not available, which lowers the likelihood of an immediate attack. However, the weakness can be triggered by any XML document that enables external entity parsing, so programs that accept untrusted XML input are at greatest risk. The bug is not listed in the CISA KEV catalog, but the potential for denial of service and memory corruption warrants proactive remediation.