CVE-2026-32778

libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.

CVSS v3 2.9 LOW

2.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/libexpat/libexpat/pull/1159	Issue Tracking Patch
https://github.com/libexpat/libexpat/pull/1163	Issue Tracking Patch
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*

History

14 Jul 2026, 13:18

Type	Values Removed	Values Added
References		() https://cert-portal.siemens.com/productcert/html/ssa-082556.html -

17 Jun 2026, 10:36

Type	Values Removed	Values Added
Summary		(es) libexpat antes de 2.7.5 permite una desreferenciación de puntero NULL en la función setContext al reintentar después de una condición previa de falta de memoria.

17 Mar 2026, 15:52

Type	Values Removed	Values Added
First Time		Libexpat Project libexpat Libexpat Project
CPE		cpe:2.3:a:libexpat_project:libexpat::::::::
References	~~() https://github.com/libexpat/libexpat/pull/1159 -~~	() https://github.com/libexpat/libexpat/pull/1159 - Issue Tracking, Patch
References	~~() https://github.com/libexpat/libexpat/pull/1163 -~~	() https://github.com/libexpat/libexpat/pull/1163 - Issue Tracking, Patch

16 Mar 2026, 14:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-16 14:19

Updated : 2026-07-14 13:18

NVD link : CVE-2026-32778

Mitre link : CVE-2026-32778

CVE.ORG link : CVE-2026-32778

JSON object : View

Products Affected

libexpat_project

libexpat

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-32778", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32778", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T14:38:41.545343Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "libexpat project", "product": "libexpat", "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-03-16T14:19:44.970", "references": [{"url": "https://github.com/libexpat/libexpat/pull/1159", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/libexpat/libexpat/pull/1163", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition."}, {"lang": "es", "value": "libexpat antes de 2.7.5 permite una desreferenciaci\u00f3n de puntero NULL en la funci\u00f3n setContext al reintentar despu\u00e9s de una condici\u00f3n previa de falta de memoria."}], "lastModified": "2026-07-14T13:18:49.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE95FCA4-11DD-4E66-8259-4884F323D57B", "versionEndExcluding": "2.7.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}