CVE-2021-46143

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.4.3

Description The issue is related to an integer overflow in the doProlog function of the xmlparse.c file in the Expat library. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability exists due to an integer overflow for m groupSize.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the doProlog function in xmlparse.c until a patch is available. Avoid using the m groupSize variable in the affected function to minimize the risk of exploitation.