Read the docs
TI-2022-07855 Aliases CVE-2022-23852GHSA-h83g-c7g2-6r9h

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for…

Priority MEDIUM 57CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 12 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05083 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 12 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*before 2.4.4Vulnerablelibexpat project
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*before 8.15.3; 10.0.0 to before 10.1.1VulnerableTenable
cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:*6.3.1VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*before 3.1VulnerableSiemens
  • cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions before 2.4.4 Vulnerable ·libexpat project
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:* Versions before 8.15.3; 10.0.0 to before 10.1.1 Vulnerable ·Tenable
  • cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:* Versions 6.3.1 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:* Versions before 3.1 Vulnerable ·Siemens

Remediation

Red Hat 4 advisories

  • RHSA-2022:7144 Released 2022-10-26 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update
    • Red Hat JBoss Core Services
  • RHSA-2022:4834 Released 2022-05-31 · Red Hat rating Moderate
    expat security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) expat-2.2.5-4.el8_4.3, expat-devel-2.2.5-4.el8_4.3
  • RHSA-2022:1069 Released 2022-03-28 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux Client (v. 7) expat-2.1.0-14.el7_9
    • Red Hat Enterprise Linux Client Optional (v. 7) expat-devel-2.1.0-14.el7_9, expat-static-2.1.0-14.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) expat-devel-2.1.0-14.el7_9, expat-static-2.1.0-14.el7_9
    • Red Hat Enterprise Linux Server (v. 7) expat-2.1.0-14.el7_9, expat-2.1.0-14.el7_9.ppc, expat-devel-2.1.0-14.el7_9 +1
    • Red Hat Enterprise Linux Server Optional (v. 7) expat-static-2.1.0-14.el7_9, expat-static-2.1.0-14.el7_9.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) expat-2.1.0-14.el7_9, expat-devel-2.1.0-14.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) expat-static-2.1.0-14.el7_9
Show 1 more Red Hat advisories
  • RHSA-2022:0951 Released 2022-03-16 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS (v. 8) expat-2.2.5-4.el8_5.3, expat-devel-2.2.5-4.el8_5.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 9)Fixed—
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2022:0951
Red Hat Enterprise Linux BaseOS (v. 9)Fixed—
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2022:4834
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2022:1069
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2022:1069
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2022:1069
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:1069
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:1069
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:1069
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2022:1069
Red Hat JBoss Core ServicesFixed RHSA-2022:7144
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23852
  2. 2026-10-03 Alias added: GHSA-h83g-c7g2-6r9h
  3. 2026-10-09 Fix available: RHSA-2022:7144 · Red Hat
  4. 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat

References

Patch 1

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences