The vulnerability lies in the libxml2 library's xmlregexp module. When the function xmlRegNewParserCtxt attempts to allocate memory with strdup and that allocation fails, the code dereferences a NULL pointer without re‑evaluating the string length. This flaw can cause the library to crash or terminate unexpectedly. The weaknesses are classified as Unchecked Return Value (CWE‑252) and NULL Pointer Dereference (CWE‑476).

The issue affects versions of libxml2 prior to 2.15.4, including 2.15.3 and earlier releases. Any software that links against these older libxml2 binaries is potentially impacted.

The CVSS score of 2.9 indicates a low severity risk. The EPSS score of 0.00116 (approximately 0.12%) and the fact that the vulnerability is not listed in CISA's KEV catalog suggest limited exploitation attempts. The likely attack vector is local: a process or user that feeds crafted XML data to an application using the vulnerable libxml2 version. Because the flaw results in a crash rather than arbitrary code execution or privilege escalation, the immediate risk is predominantly a denial‑of‑service to the affected process.