CVE-2026-24515 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	2.9 LOW	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 6%

Affected Products (NVD)

Vendor	Product	Version
libexpat_project	libexpat	𝑥 < 2.7.4

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	RUGGEDCOM RST2428P	𝑥 < V4.0	ADP

Debian Releases

Debian Product

Codename

expat

bookworm	no-dsa
bookworm (security)	vulnerable
bullseye	postponed
bullseye (security)	vulnerable
forky	2.8.2-1 fixed
sid	2.8.2-1 fixed
trixie	no-dsa

openSUSE / SLES Releases

openSUSE Product

Release

expat

suse enterprise desktop 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise server 12 SP3	2.7.1-21.49.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.34.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.9.2 fixed

libexpat-devel

suse enterprise desktop 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.34.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.9.2 fixed

libexpat1

suse enterprise desktop 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise server 12 SP3	2.7.1-21.49.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.34.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.9.2 fixed

libexpat1-32bit

suse enterprise desktop 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.9.2 fixed
suse enterprise server 12 SP3	2.7.1-21.49.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.34.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.9.2 fixed

Azure Linux Releases

Azure Package

Release

expat

Azure Linux 3.0	0:2.6.4-4.azl3 fixed
CBL-Mariner 2.0	0:2.6.4-3.cm2 fixed

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Vulnerability Media Exposure

[GERMAN] Dell PowerProtect Data Domain: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um seine Privilegien zu erhöhen um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.
Published: 2026-07-02T22:00:00+00:00

References

https://github.com/libexpat/libexpat/pull/1131

https://cert-portal.siemens.com/productcert/html/ssa-253495.html