Executive brief
libexpat, a widely used library for processing XML data, contains a flaw that can cause software to crash. This occurs when the library attempts to recover from a memory shortage while processing specific data. An exploit could lead to a denial-of-service condition, potentially impacting the availability of industrial controllers and other applications that rely on this library for data processing.
Technical details
A NULL pointer dereference exists in libexpat's setContext() function. The vulnerability occurs because the lookup() function creates a PREFIX entry before poolCopyString() attempts to copy the prefix name. If the initial copy fails due to an out-of-memory (OOM) condition, a 'zombie' entry with a NULL name is left in the DTD pool. Because the parser remains in the XML_INITIALIZED state, a subsequent retry triggers keyeq() on this malformed entry, leading to the dereference. This can be exploited by a local attacker to cause a denial-of-service (crash). The issue is resolved in libexpat version 2.7.5 by ensuring the name is copied to the pool before the lookup occurs.
Affected products
- libexpat project libexpat before 2.7.5
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 before V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6
Timeline
- 2026-03-07: disclosed: Initial fix submitted via pull request
- 2026-03-16: patched: Fix merged into libexpat master branch
- 2026-03-16: advisory: NVD publication date
- 2026-07-14: advisory: Siemens advisory update confirming impact on SIMATIC S7-1500 CPUs