Log in Start free

Vulnerability · Published Jan 26, 2022 · Assigned by mitre

CVE-2022-23990

High 7.5

In plain English

A high-severity integer overflow in the expat package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)4.7%top 8.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8expat2.5.0-1.el8_10ALSA-2025:21776
AlmaLinux:8expat-devel2.5.0-1.el8_10ALSA-2025:21776
AlmaLinux:8mingw32-expat2.4.8-1.el8ALSA-2022:7811
AlmaLinux:8mingw64-expat2.4.8-1.el8ALSA-2022:7811
Alpine:v3.20expat2.4.4-r0ALPINE-CVE-2022-23990
Alpine:v3.21expat2.4.4-r0ALPINE-CVE-2022-23990
Alpine:v3.22expat2.4.4-r0ALPINE-CVE-2022-23990
Alpine:v3.23expat2.4.4-r0ALPINE-CVE-2022-23990
Alpine:v3.24expat2.4.4-r0ALPINE-CVE-2022-23990
Debian:12expat2.4.3-3DEBIAN-CVE-2022-23990
Debian:13expat2.4.3-3DEBIAN-CVE-2022-23990
Debian:14expat2.4.3-3DEBIAN-CVE-2022-23990
Debian:12libxmltokno fix listedDEBIAN-CVE-2022-23990
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2022-23990
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2022-23990
Ubuntu:22.04:LTSfirefox1:1snap1-0ubuntu1UBUNTU-CVE-2022-23990
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2022-23990
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2022-23990
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2022-23990
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2022-23990
Ubuntu:22.04:LTSthunderbirdno fix listedUBUNTU-CVE-2022-23990
Ubuntu:24.04:LTSthunderbirdno fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10thunderbirdno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.04:LTSthunderbirdno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10thunderbirdno fix listedUBUNTU-CVE-2022-23990
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2022-23990
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2022-23990
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2022-23990
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2022-23990

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References