libexpat NULL Deref and Integer Overflow Flaws

Integer overflow in libexpat through 2.9.0's storeAtts() can crash applications or corrupt heap memory when they parse attacker-supplied XML whose single start tag carries more than 2^30 attributes, and the assessed impact is high availability with no confidentiality or integrity effect. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H: no authentication or user interaction is required, but exploitation is gated by the need to deliver and parse a multi-gigabyte document, so front-end size or quota limits may prevent it. No public exploit was identified at time of analysis, and patch references exist upstream in libexpat PR #1450 and related commits.

A denial-of-service NULL pointer dereference (CWE-476) in libexpat through 2.9.0 lets remote, unauthenticated attackers crash applications that parse XML with external-entity subparsing enabled, by controlling how input is split across XML_Parse calls so an external-entity subparser's first parse is an empty, non-final buffer. Only availability is affected (VC:N/VI:N/VA:H) and there is no memory corruption, code execution, or data exposure described; the vendor's own patch (PR #1444, commit 7b0d50e4) plus a VulnCheck advisory make the mechanism well-established rather than speculative. No public exploit code and no CISA KEV entry were identified at time of analysis, though exploitation has real preconditions: the application must use XML_ExternalEntityParserCreate via an external-entity-ref handler and the attacker must influence stream chunking.