# CVE-2024-45491: libexpat integer overflow in dtdCopy function

Source: https://junglewise.ai/threats/cve-2024-45491-libexpat-integer-overflow-in-dtdcopy-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-30. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-45491 · Severity: critical · CVSS 9.8 · Published 2024-08-30

libexpat is a widely used software library for processing XML data. A vulnerability in this library could allow an attacker to crash an application or potentially execute unauthorized code by providing a specially crafted XML file. This affects any software that relies on libexpat to handle XML input, potentially leading to service outages or data breaches.

Technologies: [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project).

## Quick answers

**Is CVE-2024-45491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-45491 being exploited in the wild.

**How severe is CVE-2024-45491?** Critical severity, with a CVSS score of 9.8, published 30 August 2024.

**Which products and versions are affected?** libexpat project libexpat before 2.6.3.

**Is there a fix for CVE-2024-45491?** A patch was published on 2024-09-04: libexpat version 2.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-45491 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-45491?** Check whether you run Libexpat Project Libexpat. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in libexpat's xmlparse.c within the dtdCopy function. On 32-bit platforms where UINT_MAX equals SIZE_MAX, the nDefaultAtts variable can overflow during processing. An attacker can exploit this by providing a malicious XML document with a large number of default attributes, leading to a heap-based buffer overflow. This can result in a denial of service (application crash) or remote code execution. The issue is fixed in version 2.6.3.

## Affected products

- libexpat project libexpat before 2.6.3

## Timeline

- 2024-08-26: disclosed: Issue reported on GitHub by TaiYou-TW
- 2024-08-30: advisory: CVE-2024-45491 assigned and published
- 2024-09-04: patched: libexpat version 2.6.3 released

## References

- [https://github.com/libexpat/libexpat/issues/888](https://github.com/libexpat/libexpat/issues/888)
- [https://github.com/libexpat/libexpat/pull/891](https://github.com/libexpat/libexpat/pull/891)
- [https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html](https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html)
- [https://security.netapp.com/advisory/ntap-20241018-0003/](https://security.netapp.com/advisory/ntap-20241018-0003/)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-613116.html](https://cert-portal.siemens.com/productcert/html/ssa-613116.html)

## Related threats

- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)
- [Python CPython denial of service in XML parsers](https://junglewise.ai/threats/cve-2026-7210-python-cpython-denial-of-service-in-xml-parsers)
- [libexpat denial of service via attribute name collision check](https://junglewise.ai/threats/cve-2026-45186-libexpat-denial-of-service-via-attribute-name-collision-check)