CVE-2022-23990
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Published Jan 26, 2022 · updated Oct 14, 2026 · libexpat project libexpat
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jan 26, 2022 · NIST NVD
Detected
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Oct 14, 2026 · NIST NVD
Updated
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe fedoraproject/fedora34
- cpe fedoraproject/fedora35
- cpe libexpat project/libexpatversion unspecified
- cpe oracle/communications metasolv solution6.3.1
- cpe siemens/sinema remote connect serverversion unspecified
- cpe tenable/nessusversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2022-23990
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2022-23990
30-day exploitation probability 4.7%
first.org - NIST NVDVulnerability recordCVE-2022-23990
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
nvd.nist.gov