PatchSiren cyber security CVE debrief

CVE-2026-32777 libexpat project CVE debrief

CVE-2026-32777 is a medium-severity vulnerability in libexpat before version 2.7.5, which allows an infinite loop while parsing DTD content, causing a Denial of Service impact. The vulnerability affects Hitachi Energy's RTU500 series CMU Firmware if IEC 61850 functionality is configured. The vulnerability was published on May 26, 2026, and modified on June 4, 2026. The CVSS score is 5.5, and the severity is MEDIUM.

Vendor: libexpat project
Product: RTU500 series CMU Firmware
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-26
Original CVE updated: 2026-06-04
Advisory published: 2026-05-26
Advisory updated: 2026-06-04

Who should care

Organizations using Hitachi Energy's RTU500 series CMU Firmware with IEC 61850 functionality configured should prioritize patching this vulnerability to prevent potential Denial of Service attacks. Additionally, security teams and administrators responsible for industrial control systems should be aware of this vulnerability and take necessary precautions. CVE-2026-32777 has a medium severity, but its impact could be significant in certain industrial control system environments.

Technical summary

CVE-2026-32777 is a CWE-835 vulnerability in libexpat before version 2.7.5. The vulnerability causes an infinite loop while parsing DTD content, leading to a Denial of Service impact. The affected product is Hitachi Energy's RTU500 series CMU Firmware, but only if IEC 61850 functionality is configured. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The vulnerability was published on May 26, 2026, and modified on June 4, 2026.

Defensive priority

CVE-2026-32777 has a medium severity, but its impact could be significant in certain industrial control system environments. Organizations should prioritize patching this vulnerability to prevent potential Denial of Service attacks.

Recommended defensive actions

Update to CMU Firmware version 13.8.2
Follow general mitigation factors/workarounds
Update to CMU Firmware version 13.7.9 (when available) or 13.8.2
Monitor system logs for potential Denial of Service attacks
Implement network segmentation to limit the spread of potential attacks

Evidence notes

The vulnerability is caused by an infinite loop in libexpat before version 2.7.5 while parsing DTD content. The affected product is Hitachi Energy's RTU500 series CMU Firmware. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The vulnerability was published on May 26, 2026, and modified on June 4, 2026.

Sources and references

Verified primary and authoritative sources

CVE-2026-32777 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-32777

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-32777 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32777

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-155-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.