CVE-2024-45490

What it actually does

xmlparse.c in libexpat accepts a negative length argument to XML_ParseBuffer without validation, allowing subsequent integer underflow or out-of-bounds memory operations that terminate the process.

Why it matters to the business

Applications and services relying on libexpat can be forced offline by remote or local inputs, producing availability loss until the process is restarted or the library is updated.

How an attack unfolds

An attacker supplies an XML document or invokes the parsing API with a negative buffer length value; the missing check permits the parser to dereference invalid memory offsets, triggering a crash without requiring authentication or user interaction.

How to fix it

Upgrade libexpat to the commit 88b3ed553d8ad335559254863a33360d55b9f1d6 or later release that enforces non-negative lengths in XML_ParseBuffer; rebuild and redeploy all dependent binaries.

How to confirm the fix worked

Confirm the installed libexpat version or commit hash is at or beyond 88b3ed553d8ad335559254863a33360d55b9f1d6; run unit tests that pass negative lengths to XML_ParseBuffer and verify they are rejected with an error rather than crashing.

Typical attack path

1. Identify a network-accessible service or application that links against a vulnerable libexpat build
2. Craft an XML payload or API call containing a negative length parameter for XML_ParseBuffer
3. Deliver the input over the network or locally
4. Observe process termination and service denial

How to detect it

Review application and system logs for unexpected libexpat process crashes or segmentation faults during XML parsing; correlate with inbound XML traffic or API calls that precede the failure; monitor for repeated restarts of services that embed libexpat.

What your security team should do

• Immediately inventory all systems and containers that ship or link libexpat and schedule upgrades to the fixed commit
• Prioritize patching internet-facing services first due to the network attack vector and high availability impact
• Add libexpat version checks to build pipelines and dependency scanners to prevent re-introduction of vulnerable builds