CVE-2022-23852
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Published Jan 24, 2022 · updated Oct 14, 2026 · libexpat project libexpat
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jan 24, 2022 · NIST NVD
Detected
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Oct 14, 2026 · NIST NVD
Updated
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Affected
- cpe debian/debian linux9.0
- cpe libexpat project/libexpatversion unspecified
- cpe netapp/clustered data ontapversion unspecified
- cpe netapp/oncommand workflow automationversion unspecified
- cpe oracle/communications metasolv solution6.3.1
- cpe siemens/sinema remote connect serverversion unspecified
- cpe tenable/nessusversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2022-23852
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2022-23852
30-day exploitation probability 5.1%
first.org - NIST NVDVulnerability recordCVE-2022-23852
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
nvd.nist.gov