Junglewise Threat Intelligence

CVE-2024-45492: libexpat integer overflow in nextScaffoldPart

CVE-2024-45492 · Severity: critical · CVSS 9.8 · Published 2024-08-30

Technologies: libexpat Project libexpat. Vendors: Libexpat Project.

Executive brief

libexpat is a widely used software library for processing XML data. A vulnerability in this library could allow an attacker to crash applications or potentially execute unauthorized code by providing a specially crafted XML file. This affects systems running on 32-bit architectures and could lead to service outages or data breaches depending on how the library is integrated into specific applications.

Technical details

An integer overflow vulnerability exists in libexpat's xmlparse.c within the nextScaffoldPart function. On 32-bit platforms where UINT_MAX equals SIZE_MAX, the m_groupSize variable can overflow during XML parsing. This flaw can be triggered by a remote attacker providing a malicious XML document, leading to a heap-based buffer overflow. Successful exploitation may result in a denial of service (application crash) or arbitrary code execution. The issue is fixed in libexpat version 2.6.3.

Affected products

  • libexpat project libexpat versions before 2.6.3

Timeline

  • 2024-08-26: disclosed: Issue reported on GitHub by TaiYou-TW
  • 2024-08-30: advisory: CVE-2024-45492 published
  • 2024-09-03: patched: Fix merged into master branch
  • 2024-09-04: patched: Version 2.6.3 released

References

Related threats