Executive brief
libexpat is a widely used software library for parsing XML data, integrated into many operating systems and industrial products like Siemens RUGGEDCOM switches. A flaw in how the library handles specific data encoding settings could lead to a program crash. This primarily impacts the reliability and availability of applications that process untrusted XML files.
Technical details
A vulnerability exists in libexpat's XML_ExternalEntityParserCreate function where it fails to properly copy user data associated with unknown encoding handlers when creating an external entity parser. This flaw can lead to a NULL pointer dereference (CWE-476) during XML processing. An attacker with the ability to provide specially crafted XML content to an application using libexpat could trigger a denial-of-service (crash). The attack vector is local and requires high complexity to exploit. The issue is resolved in libexpat version 2.7.4 and Siemens SINEC OS V4.0.
Affected products
- libexpat project libexpat versions before 2.7.4
- Siemens SINEC OS versions before V4.0
- Siemens RUGGEDCOM RST2428P all versions before V4.0
Timeline
- 2026-01-19: other: Issue reported and fix developed in libexpat GitHub repository
- 2026-01-23: disclosed: CVE-2026-24515 assigned and published
- 2026-01-31: patched: libexpat 2.7.4 released
- 2026-06-02: advisory: Siemens published advisory SSA-253495 regarding SINEC OS products