Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXT_BYTES.
{ "urgency": "not yet assigned" }