CVE-2022-23852criticalCWE-190

CVE-2022-23852

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 4.5%

from disclosure to weapon106 days

Published on NVDJan 24

1st PoC+106d

exploitation probability

4.5%top 9% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

public PoCs found — 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References