CVE-2022-22825
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Published Jan 10, 2022 · updated Oct 14, 2026 · libexpat project libexpat
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jan 10, 2022 · NIST NVD
Detected
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Oct 14, 2026 · NIST NVD
Updated
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe libexpat project/libexpatversion unspecified
- cpe siemens/sinema remote connect serverversion unspecified
- cpe tenable/nessusversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2022-22825
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2022-22825
30-day exploitation probability 2.8%
first.org - NIST NVDVulnerability recordCVE-2022-22825
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
nvd.nist.gov