CVE-2026-32776: libexpat NULL pointer dereference in XML entity parsing

CVE-2026-32776 · Severity: medium · CVSS 4 · Published 2026-03-16

libexpat is a widely used software library for parsing XML data, found in many operating systems and industrial controllers like Siemens SIMATIC S7-1500 CPUs. A vulnerability in this library could allow an attacker to crash applications or services that process specially crafted XML files. This results in a denial-of-service, potentially disrupting business operations or industrial processes that rely on the affected software.

Technologies: Libexpat Project Libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Libexpat Project, Siemens.

Quick answers

Is CVE-2026-32776 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32776 being exploited in the wild.
How severe is CVE-2026-32776?
Medium severity, with a CVSS score of 4, published 16 March 2026.
Which products and versions are affected?
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to before V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to before V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to before V3.1.6.
Is there a fix for CVE-2026-32776?
A patch was published on 2026-03-17: libexpat version 2.7.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32776 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-32776?
Check whether you run Libexpat Project Libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in libexpat before version 2.7.5. The vulnerability occurs when an external parameter entity with empty text is referenced within an entity declaration value. In this scenario, the sub-parser receives zero bytes of input, causing it to enter the 'entityValueInitProcessor' before encoding detection has occurred. This leads 'XmlEntityValueTok' to attempt a call through a NULL pointer in the 'literalScanners' array, resulting in a segmentation fault (SEGV). An attacker can exploit this by providing a crafted XML document to an application using the library, causing a denial-of-service. The issue is fixed in libexpat 2.7.5 and Siemens firmware V3.1.6.

Affected products

  • libexpat project libexpat before 2.7.5
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to before V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to before V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to before V3.1.6

Timeline

  • 2026-03-05: other: Fix submitted via GitHub pull request
  • 2026-03-16: advisory: CVE published by NVD/MITRE
  • 2026-03-17: patched: libexpat version 2.7.5 released
  • 2026-07-14: other: Siemens updated advisory to include this CVE for specific PLC models

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.