CVE-2022-22825: Integer Overflow
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability, confidentiality and integrity.
Other sources
Expat could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow of lookup in xmlparse.c. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-22825?
CVE-2022-22825 is a vulnerability in Expat (libexpat) before version 2.4.3, causing an integer overflow in the xmlparse.c file.
What is the severity of CVE-2022-22825?
CVE-2022-22825 has a severity score of 8.8, which is considered high.
How does CVE-2022-22825 affect availability?
CVE-2022-22825 can lead to process interruption, affecting availability.
What is the remedy for CVE-2022-22825?
The recommended remedy for CVE-2022-22825 is to upgrade Expat (libexpat) to version 2.4.3.
Are there any references for CVE-2022-22825?
Yes, you can find references for CVE-2022-22825 at the following links: [GitHub Pull Request](https://github.com/libexpat/libexpat/pull/539), [Openwall Mailing List](http://www.openwall.com/lists/oss-security/2022/01/17/3), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2044482).