CVE-2024-8176

Published Mar 14, 2025

Last updated 2 days ago

libexpat

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-8176 is a stack overflow vulnerability found in the libexpat library. It stems from the way libexpat handles recursive entity expansion when parsing XML documents. The vulnerability occurs when an XML document contains deeply nested entity references. Libexpat can be forced into infinite recursion while processing these references, leading to stack exhaustion and a crash. This can potentially cause a denial-of-service (DoS) condition, and in some cases, may lead to memory corruption.

Description: A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
Source: secalert@redhat.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

secalert@redhat.com: CWE-674

Hype score: Not currently trending

References