Junglewise Threat Intelligence

CVE-2024-45491: libexpat integer overflow in dtdCopy function

CVE-2024-45491 · Severity: critical · CVSS 9.8 · Published 2024-08-30

Technologies: Libexpat Project Libexpat. Vendors: Libexpat Project.

Executive brief

libexpat is a widely used software library for processing XML data. A vulnerability in this library could allow an attacker to crash an application or potentially execute unauthorized code by providing a specially crafted XML file. This affects any software that relies on libexpat to handle XML input, potentially leading to service outages or data breaches.

Technical details

An integer overflow vulnerability exists in libexpat's xmlparse.c within the dtdCopy function. On 32-bit platforms where UINT_MAX equals SIZE_MAX, the nDefaultAtts variable can overflow during processing. An attacker can exploit this by providing a malicious XML document with a large number of default attributes, leading to a heap-based buffer overflow. This can result in a denial of service (application crash) or remote code execution. The issue is fixed in version 2.6.3.

Affected products

  • libexpat project libexpat before 2.6.3

Timeline

  • 2024-08-26: disclosed: Issue reported on GitHub by TaiYou-TW
  • 2024-08-30: advisory: CVE-2024-45491 assigned and published
  • 2024-09-04: patched: libexpat version 2.6.3 released

References

Related threats