CVE-2026-24515
📋 TL;DR
This vulnerability in libexpat's XML_ExternalEntityParserCreate function fails to copy unknown encoding handler user data, potentially causing crashes or undefined behavior when processing malformed XML with custom encoding handlers. It affects applications using vulnerable libexpat versions to parse XML from untrusted sources.
💻 Affected Systems
- libexpat
- Any software using libexpat library
📦 What is this software?
Libexpat by Libexpat Project
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service, or potential memory corruption that could be leveraged for further exploitation in specific configurations.
Likely Case
Application instability or crashes when processing specially crafted XML files with custom encoding handlers.
If Mitigated
Minimal impact if applications don't use custom encoding handlers or don't parse untrusted XML.
🎯 Exploit Status
Exploitation requires specific application configuration with custom encoding handlers and malformed XML input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.4
Vendor Advisory: https://github.com/libexpat/libexpat/pull/1131
Restart Required: Yes
Instructions:
1. Update libexpat to version 2.7.4 or later. 2. Recompile applications using libexpat if statically linked. 3. Restart affected services.
🔧 Temporary Workarounds
Disable external entity parsing
allConfigure applications to disable XML external entity processing if not required
Set XML_PARSE_NOENT flag to 0 in expat parser initialization
🧯 If You Can't Patch
- Implement input validation to reject malformed XML before parsing
- Use network controls to limit XML input to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check libexpat version: expat --version or ldd on binary to check linked library versionCheck Version:
expat --version 2>&1 | head -1Verify Fix Applied:
Verify libexpat version is 2.7.4 or higher and applications have been restarted📡 Detection & Monitoring
Log Indicators:
- Application crashes during XML parsing
- Segmentation faults in XML processing components
Network Indicators:
- Unusual XML file uploads to applications
- XML parsing errors in application logs
SIEM Query:
source="application.log" AND ("segmentation fault" OR "XML parse error") AND process="*expat*"