The vulnerability lies in the libxml2 library's xmlregexp module. When the function xmlRegNewParserCtxt attempts to allocate memory with strdup and that allocation fails, the code dereferences a NULL pointer without re‑evaluating the string length. This flaw can cause the library to crash or terminate unexpectedly. The weakness is classified as Unchecked Return Value (CWE‑252).

The issue affects versions of libxml2 prior to 2.15.4, including 2.15.3 and earlier releases. Any software that links against these older libxml2 binaries is potentially impacted.

The CVSS score of 2.9 indicates a low severity risk. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, implying limited exploitation evidence. The likely attack vector is local: a process or user that feeds crafted XML data to an application using the vulnerable libxml2 version. Because the flaw results in a crash rather than arbitrary code execution or privilege escalation, the immediate risk is predominantly a denial‑of‑service to the affected process.