PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32778 libexpat project CVE debrief

CVE-2026-32778 is a medium-severity vulnerability in Hitachi Energy's RTU500 series CMU Firmware. The vulnerability is caused by a NULL pointer dereference in the function setContext on retry after an earlier out-of-memory condition in libexpat before 2.7.5. This results in a Denial of Service impact. The product is only affected if IEC 61850 functionality is configured. According to the CISA advisory, ICSA-26-155-04, the affected versions include 12.7.1 – 12.7.7, 13.5.1 – 13.5.4, 13.6.1 – 13.6.3, 13.7.1 – 13.7.8, and 13.8.1. Hitachi Energy has provided updates to mitigate this vulnerability, including updating to CMU Firmware version 13.8.2 or 13.7.9 when available.

Vendor
libexpat project
Product
RTU500 series CMU Firmware
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-06-04
Advisory published
2026-05-26
Advisory updated
2026-06-04

Who should care

Organizations using Hitachi Energy's RTU500 series CMU Firmware, particularly those with IEC 61850 functionality configured, should be aware of this vulnerability. This includes industries relying on industrial control systems, such as utilities and critical infrastructure sectors. The vulnerability's medium severity and potential for Denial of Service impact make it important for defenders to assess their exposure and take appropriate mitigation steps.

Technical summary

CVE-2026-32778 is a NULL pointer dereference vulnerability in libexpat before version 2.7.5. The vulnerability occurs in the setContext function when it is called on retry after an earlier out-of-memory condition. This leads to a Denial of Service (DoS) impact. The RTU500 series CMU Firmware from Hitachi Energy is affected if IEC 61850 functionality is configured. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.5, indicating a medium severity level. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, reflecting Local Attack Vector, Low Attack Complexity, Low Privileges Required, and High Availability impact.

Defensive priority

Defenders should prioritize updating to CMU Firmware version 13.8.2 or 13.7.9 when available. Additionally, defenders should follow general mitigation factors and workarounds provided by Hitachi Energy and CISA.

Recommended defensive actions

  • Update to CMU Firmware version 13.8.2
  • Apply updates to CMU Firmware version 13.7.9 when available
  • Follow general mitigation factors and workarounds provided by Hitachi Energy and CISA
  • Assess exposure and take appropriate mitigation steps
  • Monitor for IEC 61850 functionality configuration and its impact on the system

Evidence notes

The CISA advisory ICSA-26-155-04 provides detailed information about the vulnerability, including affected versions and mitigation steps. Hitachi Energy has provided updates to mitigate this vulnerability. The CVE record and NVD detail provide additional context and scoring information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32778 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32778

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32778 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32778

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-155-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.