CVE-2022-22827
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Published Jan 10, 2022 · updated Oct 14, 2026 · libexpat project libexpat
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jan 10, 2022 · NIST NVD
Detected
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Oct 14, 2026 · NIST NVD
Updated
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe libexpat project/libexpatversion unspecified
- cpe siemens/sinema remote connect serverversion unspecified
- cpe tenable/nessusversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2022-22827
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2022-22827
30-day exploitation probability 3.0%
first.org - NIST NVDVulnerability recordCVE-2022-22827
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
nvd.nist.gov