CVE-2024-45492: Integer Overflow
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for mgroupSize on 32-bit platforms (where UINTMAX equals SIZEMAX).
Other sources
libexpat could allow a local attacker to execute arbitrary code on the system, caused by an integer overflow in the nextScaffoldPart function in xmlparse.c. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-45492?
CVE-2024-45492 is classified with a severity that indicates a significant risk due to the integer overflow vulnerability in libexpat.
How do I fix CVE-2024-45492?
To fix CVE-2024-45492, upgrade libexpat to version 2.6.3 or later.
Which versions of libexpat are affected by CVE-2024-45492?
CVE-2024-45492 affects all versions of libexpat prior to 2.6.3.
Is CVE-2024-45492 exploited in the wild?
As of now, there is no public information available indicating that CVE-2024-45492 is actively being exploited in the wild.
What types of systems are vulnerable to CVE-2024-45492?
CVE-2024-45492 primarily affects 32-bit platforms due to the integer overflow issue in libexpat.