CVE-2024-45492

What it actually does

Integer overflow in nextScaffoldPart within xmlparse.c allows m_groupSize to wrap on 32-bit platforms where UINT_MAX equals SIZE_MAX, resulting in memory corruption.

Why it matters to the business

Applications parsing untrusted XML on 32-bit systems may crash or allow arbitrary code execution, disrupting services and exposing data across any dependent software stacks.

How an attack unfolds

An attacker supplies a specially crafted XML document that triggers excessive group size calculations during parsing; on 32-bit builds the overflow corrupts internal structures, enabling control-flow hijacking or denial of service.

How to fix it

Upgrade libexpat to commit 88b3ed553d8ad335559254863a33360d55b9f1d6 or later release 2.6.3; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm the installed libexpat version or commit hash is at or beyond the fixed revision; run regression tests with XML payloads that previously triggered the overflow.

Typical attack path

1. Identify a network-accessible service or application that uses a vulnerable libexpat build on a 32-bit platform.
2. Send a malicious XML payload crafted to exercise nextScaffoldPart with an oversized m_groupSize value.
3. Trigger the integer wrap and subsequent memory corruption to achieve code execution or crash the process.

How to detect it

Review application logs for unexpected crashes or memory errors during XML parsing; monitor for sudden restarts of services that embed libexpat on 32-bit hosts.

What your security team should do

• Prioritize patching all 32-bit deployments that embed or link against libexpat within the next maintenance window.
• Scan build pipelines and package manifests for references to pre-2.6.3 libexpat versions.
• Enable memory-safety tooling such as ASAN or fuzzing in CI for XML parsing components.