A heap buffer over-read exists in libexpat’s xmlparse.c, where XML_ParseBuffer increments an internal end pointer without validating the caller‑supplied length. Repeated calls can move that pointer past the allocated heap, allowing the parser to read memory beyond the buffer’s bounds. This read leaks adjacent heap data, including pointers to libc function tables and other executable code, enough to defeat ASLR and serve as a foothold for further exploit development.

The vulnerability applies to libexpat before the fix committed at 13c5f63. Any product bundles libexpat versions older than this commit are affected, regardless of distribution or packaging.

With a CVSS score of 8.3, the risk is considered high. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires that a parse buffer already exists, which is typical after a call to XML_GetBuffer or an earlier XML_Parse. Once the buffer is present, repeated XML_ParseBuffer calls can leak memory contents. An attacker can use the disclosed heap pointers and code pointers to bypass ASLR, creating a chain that can lead to remote code execution if additional privilege‑elevating or code‑execution primitives are available.