CVE-2022-23852
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Risk Assessment
Integer overflow could lead to unexpected behavior, such as memory corruption, which could result in a crash or potentially remote code execution.
Recommendation
It is recommended to upgrade the Expat library to version 2.4.4 or later.
Other vulnerabilities in Expat
See all- CVE-2022-25315Critical
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
- CVE-2022-25314High
In Expat (libexpat) before 2.4.5, there is an integer overflow in copyString.
- CVE-2022-25236Critical
In xmlparse.c in Expat (aka libexpat) before 2.4.5, attackers can insert namespace-separator characters into namespace URIs.
- CVE-2022-25235Critical
In xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
- CVE-2022-23990High
Expat (libexpat) before 2.4.4 has an integer overflow in the doProlog function. This may lead to improper XML parser behavior.
- CVE-2022-22824Critical
The defineAttribute function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.
- CVE-2022-22823Critical
The build_model function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.
- CVE-2022-22822Critical
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2021-45960High
In Expat (libexpat) before 2.4.3, a left shift by 29 or more bits in the storeAtts function in xmlparse.c can lead to realloc misbehavior, such as allocating too few bytes or only freeing memory.
- CVE-2018-20843High
In libexpat (Expat before 2.2.7), XML input including XML names with a large number of colons could make the parser consume high amounts of RAM and CPU resources, enough for denial-of-service attacks.
Original NVD description (English source)
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS