NULL Pointer Dereference in libexpat XML Parser

Executive Summary

This is a NULL pointer dereference vulnerability in libexpat through version 2.9.0. It occurs in the externalEntityInitProcessor2() function in lib/xmlparse.c when the XML_TOK_NONE token is mishandled due to empty input. Attackers controlling stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libexpat to crash when processing maliciously crafted XML input. If an attacker controls how XML data is split into chunks, they can trigger the crash during subsequent parsing operations, leading to denial-of-service conditions for the affected application.

Useful 0 Not Useful 0

Mitigation Strategies

Update libexpat to version 2.10.0 or later to address the NULL pointer dereference in externalEntityInitProcessor2().

Review and restrict XML input handling, especially from untrusted sources, to prevent malicious stream chunking.

Useful 0 Not Useful 0