Back to Database
Status published
Unknown
CVE-2022-23990
Expat (aka libexpat) before 2.4.4 has an integer overflow in...
Vulnerability Description
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23990
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/libexpat/libexpat/pull/551
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7FF2UH7MPXKTADYSJUAHI2Y5UHBSHUH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34NXVL2RZC2YZRV74ZQ3RNFB7WCEUP7D/
- https://www.debian.org/security/2022/dsa-5073
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.tenable.com/security/tns-2022-05
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://security.gentoo.org/glsa/202209-24
More from libexpat project
View All →CVE-2025-66382
In libexpat through 2.7.3, a crafted file with an approximate...
Low
2.9
CVE-2025-59375
libexpat in Expat before 2.7.2 allows attackers to trigger large...
High
7.5
CVE-2022-43680
In libexpat through 2.4.9, there is a use-after free caused...
Unknown
0
CVE-2022-40674
libexpat before 2.4.9 has a use-after-free in the doContent function...
Unknown
0
CVE-2022-25315
In Expat (aka libexpat) before 2.4.5, there is an integer...
Unknown
0
Affected Vendor
libexpat project
View all reports →Affected Software
libexpat, nessus, communications metasolv solution, debian linux, fedora, sinema remote connect server
Vulnerable Versions:
0, 10.0.0, 6.3.1, 10.0, 11.0, 34, 35
Timeline
Official Publish:
January 26th, 2022
Last Modified:
May 5th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.