VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Aug 30, 2024· Updated May 12, 2026

CVE-2024-45491

CVE-2024-45491

Description

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in libexpat's dtdCopy on 32-bit systems allows heap corruption, leading to remote code execution or denial of service.

Vulnerability

Details

An integer overflow vulnerability exists in libexpat's dtdCopy function within xmlparse.c, affecting versions prior to 2.6.3. The flaw occurs when calculating memory allocation for default attributes (nDefaultAtts). On 32-bit platforms where UINT_MAX equals SIZE_MAX, the multiplication can overflow, leading to an undersized heap buffer allocation [3][4].

Exploitation

An attacker can trigger the overflow by crafting a malicious XML document that supplies a large number of default attribute definitions, causing nDefaultAtts to exceed UINT_MAX. No authentication is required; the attack is network-based and can be delivered through any application that parses untrusted XML with expat. The CVSS v3.1 score is 9.8, reflecting the low complexity and no privileges required [1].

Impact

Successful exploitation results in heap corruption, which can be leveraged to execute arbitrary code or cause a denial of service. The vulnerability is especially dangerous in embedded and industrial control systems (e.g., Siemens SIMATIC S7-1500 family) where expat is used to parse configuration or communication data [1][2].

Mitigation

The issue is fixed in libexpat 2.6.3 [3]. Users are advised to update immediately. Siemens has released product-specific advisories (SSA-082556) for affected devices [1]. No public exploit code is known at the time of publication.

References
  1. SSA-082556
  2. SSA-613116
  3. [CVE-2024-45491] lib: Detect integer overflow in `dtdCopy` (fixes #888) by hartwork · Pull Request #891 · libexpat/libexpat
  4. CVE-2024-45491

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.