The libexpat library, which is widely used for XML parsing, contains a flaw in earlier releases where it does not track the depth of handler calls during processing with custom encoding callbacks. This omission allows a use‑after‑free condition to occur, resulting in memory corruption that could be leveraged to cause crashes or potentially execute arbitrary code. The flaw is identified as a classic Use‑After‑Free issue (CWE‑416) and improper resource handling (CWE‑825).

Affected for any installation of libexpat prior to version 2.8.4, including all derivatives that use the legacy library without the depth‑tracking patch. This includes applications that compile their own copy or link against libexpat from package managers when the version is older than 2.8.4. The vulnerability is specific to the handling of custom encoding callbacks invoked by XML input streams.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known deployed exploits. The primary attack vector is likely an untrusted XML source processed through a custom encoding callback; an attacker could craft XML that triggers the use‑after‑free. Because of this, upgrading to a patched version is strongly recommended.