A heap use-after-free vulnerability was discovered in the XML parsing C library. It is tracked as CVE-2022-40674. The vulnerability could result in denial of service or potentially the execution of arbitrary code.
Getting all dependencies patched could take a lot of time. For the moment, at least there is not PoC available and the supply chain apocalypse is postponed.