CVE-2024-50602

What it actually does

Causes a crash inside XML_ResumeParser when XML_StopParser is invoked on a parser that was never started.

Why it matters to the business

Applications that use the library for XML processing can be forced to terminate unexpectedly, producing service outages until the process is restarted.

How an attack unfolds

An attacker supplies specially formed XML input that causes the library to call XML_StopParser before the parser has been initialized; a subsequent call to XML_ResumeParser then dereferences invalid state and crashes the process.

How to fix it

Upgrade libexpat to the version containing commit 2691aff4304a6d7e053199c205620136481b9dd1 (2.6.4 or newer) and rebuild all dependent applications.

How to confirm the fix worked

Confirm the installed libexpat shared library or header reports a version at or above the fixed commit; exercise the parser start/stop API paths with test cases that previously triggered the crash.

Typical attack path

1. Attacker identifies an application that links against a vulnerable libexpat build.
2. Attacker sends crafted XML content that triggers the stop-before-start sequence.
3. XML_StopParser suspends an unstarted parser.
4. Later XML_ResumeParser call triggers the crash, terminating the process.

How to detect it

Review application and system logs for abrupt process termination immediately after XML parsing activity; correlate with any inbound XML payloads that precede the crash.

What your security team should do

• Prioritize upgrade of libexpat and all packages that statically or dynamically link it.
• Add the fixed commit hash to dependency scanners and block builds that pull older versions.
• Monitor application crash logs for XML parser termination events while the upgrade is rolled out.