sdpb vendors a copy of tinyxml2 at:
  src/tinyxml2/tinyxml2.cpp

This copy predates commit a737ecb (May 2026) which fixes an integer
overflow in GetCharacterRef() that could allow heap corruption via
crafted XML input. The fix adds:

  if (digitScaled > MAX_CODE_POINT || ucs > MAX_CODE_POINT - digitScaled)
      return 0;

No CVE has been assigned yet. The fix is public at:
https://github.com/leethomason/tinyxml2/commit/a737ecb

Please update the bundled tinyxml2 to the latest upstream version.

Found by: Attack of the Clones GSoC 2026 pipeline
  (salsa.debian.org/rouca/gsoc2026)

Gajendra