# CVE-2024-45492: libexpat integer overflow in nextScaffoldPart

Source: https://junglewise.ai/threats/cve-2024-45492-libexpat-integer-overflow-in-nextscaffoldpart  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-30. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-45492 · Severity: critical · CVSS 9.8 · Published 2024-08-30

libexpat is a widely used software library for processing XML data. A vulnerability in this library could allow an attacker to crash applications or potentially execute unauthorized code by providing a specially crafted XML file. This affects systems running on 32-bit architectures and could lead to service outages or data breaches depending on how the library is integrated into specific applications.

Technologies: [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project).

## Quick answers

**Is CVE-2024-45492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-45492 being exploited in the wild.

**How severe is CVE-2024-45492?** Critical severity, with a CVSS score of 9.8, published 30 August 2024.

**Which products and versions are affected?** libexpat Project libexpat versions before 2.6.3.

**Is there a fix for CVE-2024-45492?** A patch was published on 2024-09-03: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-45492 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-45492?** Check whether you run Libexpat Project Libexpat or libexpat Project libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in libexpat's xmlparse.c within the nextScaffoldPart function. On 32-bit platforms where UINT_MAX equals SIZE_MAX, the m_groupSize variable can overflow during XML parsing. This flaw can be triggered by a remote attacker providing a malicious XML document, leading to a heap-based buffer overflow. Successful exploitation may result in a denial of service (application crash) or arbitrary code execution. The issue is fixed in libexpat version 2.6.3.

## Affected products

- libexpat project libexpat versions before 2.6.3

## Timeline

- 2024-08-26: disclosed: Issue reported on GitHub by TaiYou-TW
- 2024-08-30: advisory: CVE-2024-45492 published
- 2024-09-03: patched: Fix merged into master branch
- 2024-09-04: patched: Version 2.6.3 released

## References

- [https://github.com/libexpat/libexpat/issues/889](https://github.com/libexpat/libexpat/issues/889)
- [https://github.com/libexpat/libexpat/pull/892](https://github.com/libexpat/libexpat/pull/892)
- [https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html](https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html)
- [https://security.netapp.com/advisory/ntap-20241018-0005/](https://security.netapp.com/advisory/ntap-20241018-0005/)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-613116.html](https://cert-portal.siemens.com/productcert/html/ssa-613116.html)

## Related threats

- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)
- [Python CPython denial of service in XML parsers](https://junglewise.ai/threats/cve-2026-7210-python-cpython-denial-of-service-in-xml-parsers)
- [libexpat denial of service via attribute name collision check](https://junglewise.ai/threats/cve-2026-45186-libexpat-denial-of-service-via-attribute-name-collision-check)