CVE-2026-32778: libexpat NULL pointer dereference in setContext function

CVE-2026-32778 · Severity: low · CVSS 2.9 · Published 2026-03-16

libexpat, a widely used library for processing XML data, contains a flaw that can cause software to crash. This occurs when the library attempts to recover from a memory shortage while processing specific data. An exploit could lead to a denial-of-service condition, potentially impacting the availability of industrial controllers and other applications that rely on this library for data processing.

Technologies: Libexpat Project Expat, Libexpat Project Libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Libexpat Project, Siemens.

Quick answers

Is CVE-2026-32778 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32778 being exploited in the wild.
How severe is CVE-2026-32778?
Low severity, with a CVSS score of 2.9, published 16 March 2026.
Which products and versions are affected?
Libexpat Project Expat before 2.7.5; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 before V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6.
Is there a fix for CVE-2026-32778?
A patch was published on 2026-03-16: Fix merged into libexpat master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32778 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-32778?
Check whether you run Libexpat Project Expat, Libexpat Project Libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in libexpat's setContext() function. The vulnerability occurs because the lookup() function creates a PREFIX entry before poolCopyString() attempts to copy the prefix name. If the initial copy fails due to an out-of-memory (OOM) condition, a 'zombie' entry with a NULL name is left in the DTD pool. Because the parser remains in the XML_INITIALIZED state, a subsequent retry triggers keyeq() on this malformed entry, leading to the dereference. This can be exploited by a local attacker to cause a denial-of-service (crash). The issue is resolved in libexpat version 2.7.5 by ensuring the name is copied to the pool before the lookup occurs.

Affected products

  • libexpat project libexpat before 2.7.5
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 before V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6

Timeline

  • 2026-03-07: disclosed: Initial fix submitted via pull request
  • 2026-03-16: patched: Fix merged into libexpat master branch
  • 2026-03-16: advisory: NVD publication date
  • 2026-07-14: advisory: Siemens advisory update confirming impact on SIMATIC S7-1500 CPUs

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.