CVE-2026-4739: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4739 is an Integer Overflow or Wraparound vulnerability (CWE-190) in InsightSoftwareConsortium ITK, specifically within its bundled Expat XML parsing library (Modules/ThirdParty/Expat/src/expat). The vulnerability affects all ITK versions prior to 2.7.1 and was publicly disclosed on March 24, 2026. It carries a CVSS v4.0 base score of 9.4 (Critical), reflecting a network-accessible, low-complexity attack requiring only passive user interaction (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an integer overflow or wraparound (CWE-190) in clone functions within Modules/ThirdParty/Expat/src/expat/xmlparse.c, which ITK vendors from the upstream libexpat library. This specific class of bug was originally identified in the libexpat project as CVE-2022-22822 through CVE-2022-22828 and patched upstream via commit 9f93e80; ITK's bundled copy was not updated at that time. A community contributor (npt-1707) identified the gap and submitted a patch (PR #5351) that backports the upstream fix, which was merged on August 15, 2025, and followed by a full update to expat 2.7.1 (ITK GitHub PR). The attack vector is network-based with no privileges required, and exploitation requires only passive user interaction (e.g., processing a maliciously crafted XML file).

Successful exploitation can result in arbitrary code execution or denial of service on affected systems, potentially granting an attacker full control of the host. Given ITK's use in medical imaging and scientific computing pipelines, compromise could expose sensitive research or patient data and disrupt critical workflows. The CVSS v4.0 scoring reflects high confidentiality, integrity, and availability impacts across both the vulnerable system and downstream systems (Red Hat Bugzilla, Feedly).

The EPSS score is approximately 0.042%, indicating a relatively low but non-negligible probability of exploitation in the near term. The CVSS v4.0 metadata marks exploit maturity as "ATTACKED" (active exploitation), though the Feedly executive summary notes no confirmed public proof-of-concept or verified in-the-wild exploitation evidence at time of publication. The vulnerability is automatable and requires no authentication, lowering the barrier for opportunistic attackers. No CISA KEV catalog listing has been identified, and no specific threat actor attribution is available (Feedly).

1. Reconnaissance: Identify systems running InsightSoftwareConsortium ITK versions prior to 2.7.1, particularly those that process externally supplied XML or ITK-format data files (e.g., medical imaging pipelines, scientific data processing services).
2. Craft malicious input: Construct a specially crafted XML document designed to trigger an integer overflow in the xmlparse.c clone functions within ITK's bundled Expat library — similar to techniques used against CVE-2022-22822 in upstream libexpat.
3. Deliver payload: Supply the malicious XML file to the target application via any supported input channel (file upload, network stream, API endpoint) that causes ITK to parse the document using its bundled Expat library.
4. Trigger overflow: The integer overflow occurs during XML parsing, corrupting heap memory in a controlled or semi-controlled manner.
5. Achieve objective: Depending on exploitation precision, the attacker may achieve arbitrary code execution under the process's privileges, or cause a denial of service crash (ITK GitHub PR, Red Hat Bugzilla).

• Process: Unexpected crashes or segmentation faults in ITK-based applications during XML/data file parsing; unusual child processes spawned from ITK application processes.
• Logs: Application error logs showing heap corruption errors, memory allocation failures, or abnormal termination signals (SIGSEGV, SIGABRT) during Expat XML parsing operations.
• File System: Unexpected files written to disk by ITK application processes; presence of ITK versions prior to 2.7.1 confirmed via package manager or binary inspection.
• Network: Unusual outbound connections from ITK-based application servers following processing of externally supplied data files.

The primary remediation is to upgrade ITK to version 2.7.1 or later, which includes the backported fix for the integer overflow in the bundled Expat library (xmlparse.c), merged via PR #5351 on August 15, 2025 (ITK GitHub PR). Organizations using ITK in medical imaging or scientific computing pipelines should treat this as high priority given the Critical CVSS score. As a workaround where immediate patching is not possible, restrict the sources of XML/data files processed by ITK applications to trusted, validated inputs and isolate ITK-based services from untrusted networks (Red Hat Bugzilla).

Red Hat tracked the vulnerability via its security response process (Bugzilla bug 2450592) and assigned it high priority and severity. The ENISA European Vulnerability Database (EUVD-2026-14707) also catalogued the issue. Community discussion on Ask Ubuntu raised questions about fix availability for downstream distributions. The Tenable Nessus plugin 303702 was published to detect affected installations, and Microsoft's MSRC also referenced the CVE, suggesting broad ecosystem awareness (Red Hat Advisory, Tenable).