CVE-2024-45491

What it actually does

Integer overflow in dtdCopy function within xmlparse.c on 32-bit platforms where UINT_MAX equals SIZE_MAX, leading to potential memory corruption when handling nDefaultAtts during DTD copying.

Why it matters to the business

Applications relying on libexpat for XML processing on 32-bit systems face elevated risk of crashes or remote code execution, potentially disrupting services and exposing data across ecosystems with high library prevalence.

How an attack unfolds

An attacker crafts XML input containing a large number of default attributes to trigger the integer overflow during DTD processing in dtdCopy on vulnerable 32-bit builds, resulting in memory corruption that may be leveraged for code execution or denial of service.

How to fix it

Upgrade libexpat to version 2.6.3 or newer by applying the fix from commit 88b3ed553d8ad335559254863a33360d55b9f1d6; rebuild and redeploy all dependent applications after the update.

How to confirm the fix worked

Verify installed libexpat version is 2.6.3 or later; perform regression testing with XML inputs containing large default attribute sets on 32-bit platforms to confirm absence of overflow behavior.

Typical attack path

1. Identify target applications using vulnerable libexpat versions for XML parsing
2. Craft malicious XML document with excessive default attributes to exceed integer limits
3. Deliver the XML payload via network input, file upload, or API request
4. Trigger dtdCopy execution path leading to overflow and memory corruption
5. Exploit resulting corruption for arbitrary code execution or service disruption

How to detect it

Review application logs for unexpected crashes or memory errors during XML parsing; inspect process dumps or core files for signs of corruption in xmlparse.c paths; correlate with inbound XML traffic containing high attribute counts.

What your security team should do

• Prioritize upgrade of libexpat across all 32-bit deployments within 30 days
• Inventory all software dependencies on libexpat and schedule rebuilds
• Implement input validation or size limits on XML attribute processing as temporary control
• Monitor vendor advisories for downstream packages incorporating the fixed library