The vulnerability is an integer overflow (CWE‑190) in the xmlURIEscapeStr function within libxml2’s uri.c file. The overflow can corrupt memory during URI escaping, potentially allowing an adversary to exploit a malformed URI to cause a crash or further compromise system integrity if the affected code is executed with elevated privileges.

All installations of libxml2 older than 2.15.4 are vulnerable, including the xmlsoft:libxml2 product on any platform that uses libxml2 for XML processing. The issue is present in all versions before 2.15.4 regardless of patch or compile options.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. The likely attack vector is the processing of external or untrusted XML that contains URIs with unexpectedly large or malicious content. Successful exploitation would require the ability to supply such input to a vulnerable application. The lack of a public exploit does not preclude the use of this vulnerability as a foothold in a larger attack chain if an attacker can deliver crafted XML to a system running an old libxml2 version.