← Back to browse · API

CVE-2022-23852

Severity

CRITICAL

CVSS

9.8

EPSS

0.04525

Risk score

40.78

CISA KEV

No

PoC

No

Published

2022-01-24

Modified

2025-05-05

First seen

2026-08-07

Aliases

EUVD-2022-28778, GHSA-H83G-C7G2-6R9H

Products

n/a:n/a n/a

Sources

euvd EUVD-2022-28778

Description

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

References