5.9Media
CVE-2026-102633libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
Descripción
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
Debilidad (CWE):
CWE-190
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| libexpat | libexpat | 2.7.2 – ≤ 2.8.5 | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.7 | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.7 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.7 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.7 | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.7 |
Referencias y parches
- Pull Request #1392 issue-trackingpatch
- Patch Commit patch
- https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003 technical-description
- https://github.com/libexpat/libexpat product
- VulnCheck Advisory: libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc third-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html