Executive brief
libexpat is a widely used software library for processing XML data. A vulnerability in how it handles certain document structures can cause the software to enter an infinite loop, leading to a system hang or service outage. This affects various products that embed the library, including certain Siemens industrial controllers, potentially impacting operational availability.
Technical details
A vulnerability exists in libexpat's entityValueProcessor function where the parser can enter an infinite loop. This occurs because the XmlPrologTok function may repeatedly return XML_TOK_INSTANCE_START without advancing the internal pointer, causing the processor to stall. An attacker providing a malicious XML document with specific DTD content can trigger this condition to cause a denial of service (DoS). The issue was identified via OSS-Fuzz and is fixed in version 2.7.5 by implementing proper token validation similar to entityValueInitProcessor. Downstream products, such as Siemens SIMATIC S7-1500 CPUs, are also affected and require firmware updates.
Affected products
- libexpat project libexpat versions before 2.7.5
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6
Timeline
- 2026-03-06: disclosed: Issue reported via OSS-Fuzz/ClusterFuzz finding 486993411
- 2026-03-16: patched: Fix merged into libexpat master branch
- 2026-03-16: advisory: CVE-2026-32777 published