VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Aug 30, 2024· Updated May 12, 2026

CVE-2024-45492

CVE-2024-45492

Description

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in libexpat's nextScaffoldPart function on 32-bit platforms, fixed in version 2.6.3.

Vulnerability

Overview

CVE-2024-45492 is an integer overflow vulnerability in the nextScaffoldPart function within xmlparse.c of the libexpat XML parsing library, affecting versions prior to 2.6.3. The overflow occurs for the m_groupSize variable specifically on 32-bit platforms, where UINT_MAX equals SIZE_MAX, leading to potential memory corruption [3].

Exploitation

Conditions

The vulnerability is triggered during XML parsing when specially crafted input causes an integer overflow in the scaffold part tracking logic. No authentication is required, and the attack vector is network-based, as libexpat is widely used to parse XML data from untrusted sources. The weakness is present in the parsing of nested element structures [1][2][4].

Impact

Successful exploitation could allow an unauthenticated attacker to cause heap-based memory corruption, potentially leading to a denial of service or arbitrary code execution in the context of the application using libexpat. The CVSS v3 base score is 9.8 (Critical), reflecting the serious risk of remote compromise [1][2].

Mitigation

Status

The issue was addressed in libexpat version 2.6.3, released on September 4, 2024. Siemens has also released security advisories (SSA-082556, SSA-613116) identifying affected products like SIMATIC S7-1500 CPU family and providing remediation guidance. Users should update to the patched library version or apply vendor-specific fixes [1][2][3].

References
  1. SSA-082556
  2. SSA-613116
  3. [CVE-2024-45492] lib: Detect integer overflow in function `nextScaffoldPart` (fixes #889) by hartwork · Pull Request #892 · libexpat/libexpat
  4. CVE-2024-45492

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.