libexpat EUVD-2026-104922

Exploitation requires that the consuming application reuse a single XML_Parser across multiple documents by calling XML_ParserReset() instead of allocating a fresh parser per document, and that libexpat be built with its allocation/amplification accounting enabled (XML_GE==1, the default) - the vulnerable code path is the m_alloc_tracker.bytesAllocated counter that reset fails to offset. Limiting factors: applications that create a new parser for each document are not affected; the impact is confined to the affected parser instance and is fully recoverable by destroying and recreating it; and no authentication or user interaction is needed (PR:N/UI:N) once a reusing service is reachable over the network.

The CVSS 4.0 base score is 8.2 (High), driven entirely by availability impact (VA:H) with no confidentiality or integrity impact and no scope change - consistent with a pure denial-of-service bug. The vector shows network reachability (AV:N), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), but critically includes AT:P, a present attack requirement: exploitation depends on the target application reusing a single parser across documents via XML_ParserReset() rather than creating a fresh parser each time. This AT:P condition is the dominant risk discriminator and tempers the otherwise-remote-unauthenticated profile. Exploitation signals are weak-to-absent: there is no CISA KEV listing and no public exploit identified, so this is not confirmed to be actively exploited; EPSS and SSVC data were not provided in the input and cannot be cited. The impact is also recoverable - the application can restore service by destroying and recreating the parser - so the 'high availability' rating reflects sustained failure only within a long-lived, reused parser instance rather than a full system crash. Net: this is a legitimate but conditional DoS that matters most for long-running services that pool/reuse expat parsers; it is a patch-on-schedule issue rather than an emergency, and the high base score overstates universal real-world risk because of the parser-reuse precondition.

An attacker sends a single large XML document to a network service that reuses one libexpat parser across requests via XML_ParserReset(). Because the reset zeroes the direct byte count but never offsets the tracked heap allocation total, the inflated allocation counter persists, and every subsequent document the attacker or legitimate users submit fails with XML_ERROR_NO_MEMORY until the service recreates the parser. No public exploit code was identified, but the trigger is trivial - one oversized well-formed document.