Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
The issue is reachable over the network without authentication or user interaction, but exploitation requires an attacker to supply a malformed document to a vulnerable Expat parser in a context where that input is processed.
A malformed input document can trigger a buffer overflow, resulting in a crash and denial of service. The advisory also indicates that arbitrary code execution may be possible.
Identify applications and services that use Expat to parse documents, then determine whether they process attacker-controlled or otherwise untrusted input. The provided information does not include affected or fixed Expat version numbers.