CVE-2024-45490

HIGH EPSS 74.1%

Published Aug 30, 20241y ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Aug 30, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

EPSS Exploit Probability

74.1% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

CWE-190 Integer Overflow or Wraparound Numeric Error

CWE-611

Vendor	Product	Version	Range
libexpat_project	libexpat	*	<2.6.3

seclists.org http://seclists.org/fulldisclosure/2024/Dec/10
seclists.org http://seclists.org/fulldisclosure/2024/Dec/12
seclists.org http://seclists.org/fulldisclosure/2024/Dec/6
seclists.org http://seclists.org/fulldisclosure/2024/Dec/7
seclists.org http://seclists.org/fulldisclosure/2024/Dec/8
cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-613116.html
github.com https://github.com/libexpat/libexpat/issues/887

Issue Tracking
github.com https://github.com/libexpat/libexpat/pull/890

Patch
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html
security.netapp.com https://security.netapp.com/advisory/ntap-20241018-0004/