libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
https://github.com/libexpat/libexpat/pull/629
https://github.com/libexpat/libexpat/pull/640
https://www.debian.org/security/2022/dsa-5236
https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html
https://security.gentoo.org/glsa/202209-24