CVE-2024-45490 is a critical vulnerability in libexpat before version 2.6.3. The issue arises because the xmlparse.c source file does not validate the length parameter in the XML_ParseBuffer function, allowing a negative length to be processed. This can cause memory corruption or other severe consequences, impacting the confidentiality, integrity, and availability of affected systems. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound). No known exploits in the wild have been reported as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score of 9.8 reflects the critical nature of the flaw with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

A fix is available in libexpat version 2.6.3. Users and administrators should upgrade to version 2.6.3 or later to remediate this vulnerability. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the versioning information indicating that versions prior to 2.6.3 are affected and the issue is resolved in 2.6.3.