ZeroDay Findings
Sign inSign up

Findings

CVE-2022-23852

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Published Jan 24, 2022 · updated Oct 14, 2026 · libexpat project libexpat

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 24, 2022 · NIST NVD

    Detected

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Affected

  • cpe debian/debian linux9.0
  • cpe libexpat project/libexpatversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe netapp/oncommand workflow automationversion unspecified
  • cpe oracle/communications metasolv solution6.3.1
  • cpe siemens/sinema remote connect serverversion unspecified
  • cpe tenable/nessusversion unspecified

Sources

  • CVE.orgCVE-2022-23852

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2022-23852

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

    nvd.nist.gov

References