Libexpat

The Expat library through version 2.8.4 incorrectly validates UTF-16 surrogate pairs, allowing attackers to perform XML injection via malformed input that obscures markup characters.

The Expat XML parsing library is affected by integer overflow vulnerabilities (CVE-2022-25235, CVE-2022-25236) that can be exploited by a local attacker to achieve arbitrary code execution or denial of service.

The Expat library through version 2.8.3 contains an algorithmic complexity vulnerability in its XML attribute parsing logic that allows unauthenticated attackers to cause CPU exhaustion and denial of service.