ACN CSIRT Italia flagged 13 vulnerabilities in libexpat, including 9 rated high severity, highlighting how a small C parser can become a high-priority item for defenders.