In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data, causing Denial of Service impact.

Product is only affected if IEC 61850 functionality is configured.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user     data.(CVE-2026-24515)

    In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize     because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006167 advisory.

    In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20627-1 advisory.

    - CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may     cause a NULL       dereference (bsc#1257144).
    - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20306-1 advisory.

    - CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may     cause a NULL       dereference (bsc#1257144).
    - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0826-1 advisory.

    - CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)
    - CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0646-1 advisory.

    - CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)
    - CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0647-1 advisory.

    - CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)
    - CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-298986b2a3 advisory.

    Update to expat-2.7.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-37324381f3 advisory.

    Update to expat-2.7.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 027c6c07-065b-11f1-baae-589cfc023192 advisory.

    expat team reports:
    Update contains 2 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8023-1 advisory.

    It was discovered that Expat, contained within the xmltok library, incorrectly handled the initialization     of parsers for external entities. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-24515)

    It was discovered that Expat, contained within the xmltok library, incorrectly handled integer     calculations when allocating memory for XML tags. An attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. (CVE-2026-25210)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8022-1 advisory.

    It was discovered that Expat incorrectly handled memory when parsing certain XML files. An attacker could     possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 25.10.
    (CVE-2025-59375)

    It was discovered that Expat incorrectly handled the initialization of parsers for external entities. An     attacker could possibly use this issue to cause a denial of service. (CVE-2026-24515)

    It was discovered that Expat incorrectly handled integer calculations when allocating memory for XML tags.
    An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-25210)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the expat package has been released.

According to its self-reported version, the Tenable Nessus application running on the remote host prior to 10.10.2, 10.11.0 prior to 10.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-04 advisory.

  - In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
    (CVE-2026-24515)

  - In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize     because there is no integer overflow check for tag buffer reallocation. (CVE-2026-25210)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of expat installed on the remote host is prior to 2.7.4. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-031-01 advisory.

    New expat packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
    (CVE-2026-24515)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
505405	Siemens RUGGEDCOM RST2428P NULL Pointer Dereference (CVE-2026-24515)	Tenable OT Security	Tenable.ot	low
505374	Hitachi Energy RTU500 NULL Pointer Dereference (CVE-2026-24515)	Tenable OT Security	Tenable.ot	low
319453	EulerOS Virtualization 2.13.0 : expat (EulerOS-SA-2026-2163)	Nessus	Huawei Local Security Checks	high
319424	EulerOS Virtualization 2.10.1 : expat (EulerOS-SA-2026-2018)	Nessus	Huawei Local Security Checks	high
319396	EulerOS Virtualization 2.12.1 : expat (EulerOS-SA-2026-2073)	Nessus	Huawei Local Security Checks	high
319383	EulerOS Virtualization 2.13.1 : expat (EulerOS-SA-2026-2124)	Nessus	Huawei Local Security Checks	high
319356	EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-2098)	Nessus	Huawei Local Security Checks	high
319318	EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2026-2045)	Nessus	Huawei Local Security Checks	high
302328	Unity Linux 20.1070e Security Update: expat (UTSA-2026-006167)	Nessus	Unity Linux Local Security Checks	low
301459	SUSE SLES16 Security Update : expat (SUSE-SU-2026:20627-1)	Nessus	SuSE Local Security Checks	high
301308	openSUSE 16 Security Update : expat (openSUSE-SU-2026:20306-1)	Nessus	SuSE Local Security Checks	high
301287	openSUSE 15 Security Update : expat (SUSE-SU-2026:0826-1)	Nessus	SuSE Local Security Checks	high
300557	SUSE SLED15 / SLES15 Security Update : expat (SUSE-SU-2026:0646-1)	Nessus	SuSE Local Security Checks	high
300232	SUSE SLES12 Security Update : expat (SUSE-SU-2026:0647-1)	Nessus	SuSE Local Security Checks	high
299136	Fedora 42 : mingw-expat (2026-298986b2a3)	Nessus	Fedora Local Security Checks	low
299135	Fedora 43 : mingw-expat (2026-37324381f3)	Nessus	Fedora Local Security Checks	low
298957	FreeBSD : expat -- multiple vulnerabilities (027c6c07-065b-11f1-baae-589cfc023192)	Nessus	FreeBSD Local Security Checks	high
298808	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : xmltok library vulnerabilities (USN-8023-1)	Nessus	Ubuntu Local Security Checks	high
298805	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 25.10 : Expat vulnerabilities (USN-8022-1)	Nessus	Ubuntu Local Security Checks	high
298353	Photon OS 5.0: Expat PHSA-2026-5.0-0756	Nessus	PhotonOS Local Security Checks	high
298226	Tenable Nessus < 10.10.2 / 10.11.0 < 10.11.2 Multiple Vulnerabilities (TNS-2026-04)	Nessus	Misc.	high
298019	Photon OS 4.0: Expat PHSA-2026-4.0-0956	Nessus	PhotonOS Local Security Checks	low
297491	Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2026-031-01)	Nessus	Slackware Local Security Checks	low
296261	Linux Distros Unpatched Vulnerability : CVE-2026-24515	Nessus	Misc.	low

Detections

Analytics

CVE-2026-24515

low

Tenable Plugins

low

low

high

high

high

high

high

high

low

high

high

high

high

high

low

low

high

high

high

high

high

low

low

low