CVE-2024-50615

What it actually does

Reachable assertion failure in tinyxml2.cpp XMLUtil::GetCharacterRef when processing UINT_MAX/digit sequences, causing immediate application termination.

Why it matters to the business

Unexpected crashes in applications handling XML input on affected SUSE SLES 12 SP5 systems can interrupt archiving and data processing workflows; low EPSS and absence from KEV indicate limited active exploitation risk despite 715 days since publication.

How an attack unfolds

An attacker supplies specially crafted XML content containing character references that reach the UINT_MAX/digit assertion path in GetCharacterRef, triggering the assertion and forcing the process to exit.

How to fix it

Upgrade cpio on SUSE Linux Enterprise Server 12 SP5 and SUSE Linux Enterprise Server for SAP Applications 12 SP5 to version 2.11-36.18.1 or later.

How to confirm the fix worked

Verify installed cpio package versions match or exceed 2.11-36.18.1; re-test XML parsing paths with inputs that previously triggered the assertion.

Typical attack path

1. Identify an entry point that feeds attacker-controlled XML into a TinyXML2-based parser
2. Craft XML with a character reference designed to hit the UINT_MAX/digit condition
3. Deliver the malformed input to trigger XMLUtil::GetCharacterRef
4. Observe assertion failure and application termination

How to detect it

Search application and system logs for unexpected process exits during XML parsing; correlate crashes with TinyXML2 library calls or assertions in tinyxml2.cpp.

What your security team should do

• Apply the listed SUSE package updates during the next maintenance window
• Monitor upstream TinyXML2 releases for additional hardening
• Review XML input validation in any internal tools that embed or link against TinyXML2