Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
{ "urgency": "not yet assigned" }