ZeroDay Findings
Sign inSign up

Findings

CVE-2022-22823

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Published Jan 10, 2022 · updated Oct 14, 2026 · libexpat project libexpat

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 10, 2022 · NIST NVD

    Detected

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  2. Oct 14, 2026 · NIST NVD

    Updated

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe libexpat project/libexpatversion unspecified
  • cpe siemens/sinema remote connect serverversion unspecified
  • cpe tenable/nessusversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2022-22823

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-22823

    30-day exploitation probability 3.6%

    first.org
  • NIST NVDVulnerability recordCVE-2022-22823

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    nvd.nist.gov

References