Executive brief
libexpat is a widely used software library for parsing XML data, found in many operating systems and industrial controllers like Siemens SIMATIC S7-1500 CPUs. A vulnerability in this library could allow an attacker to crash applications or services that process specially crafted XML files. This results in a denial-of-service, potentially disrupting business operations or industrial processes that rely on the affected software.
Technical details
A NULL pointer dereference exists in libexpat before version 2.7.5. The vulnerability occurs when an external parameter entity with empty text is referenced within an entity declaration value. In this scenario, the sub-parser receives zero bytes of input, causing it to enter the 'entityValueInitProcessor' before encoding detection has occurred. This leads 'XmlEntityValueTok' to attempt a call through a NULL pointer in the 'literalScanners' array, resulting in a segmentation fault (SEGV). An attacker can exploit this by providing a crafted XML document to an application using the library, causing a denial-of-service. The issue is fixed in libexpat 2.7.5 and Siemens firmware V3.1.6.
Affected products
- libexpat project libexpat before 2.7.5
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to before V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to before V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to before V3.1.6
Timeline
- 2026-03-05: other: Fix submitted via GitHub pull request
- 2026-03-16: advisory: CVE published by NVD/MITRE
- 2026-03-17: patched: libexpat version 2.7.5 released
- 2026-07-14: other: Siemens updated advisory to include this CVE for specific PLC models