libexpat EUVD-2026-108338

Exploitation requires that the application pass attacker-controlled XML to libexpat with DTD processing and internal general/parameter entity expansion enabled - the document must carry a large DTD with nested entity definitions, which is where the delayed billion-laughs accounting in accountingDiffTolerated() fails to abort in time. No authentication or user interaction is required (PR:N/UI:N) and default DTD-parsing configurations are affected. Exploitation is limited to deployments that actually parse untrusted XML and have not disabled DTD/entity handling (e.g. via a NULL entity-expansion policy or by rejecting DOCTYPE); applications that never process external XML or that pre-filter DTDs are not reachable. Impact is confined to CPU exhaustion / denial of service - no data disclosure or modification.

This is a genuine availability risk but not a code-execution emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger with impact confined to availability (VA:H; VC:N/VI:N) - consistent with a denial-of-service CWE-776 entity-expansion flaw. The vuln.today decision label is 'this_week', not act_now/emergency, which matches a high-severity DoS rather than a wormable RCE. No EPSS score and no KEV status were provided, so there is no signal of active exploitation; a public PoC reference exists (github.com/hannob/lololol) but it is not verified as working exploit code, so exploitability should be treated as plausible rather than proven. The practical severity hinges on exposure: the real limiter is not CVSS complexity (the vector is AC:L) but whether an application actually feeds untrusted XML with DTD/entity processing to the library. Signals are internally consistent (high availability impact, network vector, patch available, moderate priority label); the main missing data is EPSS and any independent confirmation that the DoS yields the 'tens of seconds per parse' claimed in the description.

An attacker submits a moderately sized XML document containing a large DTD with nested entity definitions to any network-facing service that parses untrusted XML with libexpat (e.g. an API endpoint, SOAP/XML-RPC handler, or document upload). Because the billion-laughs accounting in accountingDiffTolerated() detects the amplification too late, each such document ties up a parser thread for tens of seconds of CPU, and repeated submissions exhaust CPU and deny service to legitimate users. A public PoC reference exists but is not verified as working exploit code.