ECHO-778A-550A-1FD5 Type confusion in xmlParseReference (ctxt vs ctxt->userData in SAX callbacks). Introduced by commit e1153832 ("parser: Fix quadratic behavior when copying entities", 2024-01-07), first released in v2.13.0. Last unaffected release: v2.12.10. Debian trixie package is 2.12.7+dfsg+really2.9.14 (effectively v2.9.14) which predates the bug — all SAX callbacks in xmlParseReference already correctly pass ctxt->userData. Verified against the actual Debian source from salsa.debian.org. Not exploitable.

Bulletin has no description...