Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2022-22826: Expat (libexpat) integer overflow in XML parsing
CVE-2022-22826 · published 4 years ago
Summary
A vulnerability in Expat's XML parsing allows an attacker to cause a crash or potentially execute malicious code. This affects older versions of Expat, specifically those before 2.4.3. To protect your system, update to a newer version of Expat that has this issue fixed.
What to do
- Update canonical expat to version 2.1.0-4ubuntu1.4+esm4.
- Update canonical expat to version 2.1.0-7ubuntu0.16.04.5+esm2.
- Update canonical libxmltok to version 1.2-3ubuntu0.16.04.1~esm2.
- Update canonical expat to version 2.2.5-3ubuntu0.4.
- Update canonical firefox to version 98.0+build3-0ubuntu0.18.04.2.
- Update canonical libxmltok to version 1.2-4ubuntu0.18.04.1~esm4.
- Update canonical expat to version 2.2.9-1ubuntu0.2.
- Update canonical firefox to version 98.0+build3-0ubuntu0.20.04.2.
- Update canonical thunderbird to version 1:91.11.0+build2-0ubuntu0.20.04.1.
- Update canonical libxmltok to version 1.2-4ubuntu0.20.04.1~esm4.
- Update canonical expat to version 2.4.3-1.
- Update canonical firefox to version 1:1snap1-0ubuntu1.
- Update canonical thunderbird to version 1:91.11.0+build2-0ubuntu0.22.04.1.
- Update canonical libxmltok to version 1.2-4ubuntu0.22.04.1~esm4.
- Update canonical libxmltok to version 1.2-4.1ubuntu2.24.0.4.1+esm2.
- Update debian expat to version 2.4.3-1.
- Update libexpat_project libexpat to version 2.4.3 or later.
- Update siemens sinema_remote_connect_server to version 3.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | expat |
< 2.1.0-4ubuntu1.4+esm4 Fix: upgrade to 2.1.0-4ubuntu1.4+esm4
|
| Ubuntu:Pro:14.04:LTS | canonical | coin3 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | vnc4 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | vtk | All versions |
| Ubuntu:14.04:LTS | canonical | xmlrpc-c | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | expat |
< 2.1.0-7ubuntu0.16.04.5+esm2 Fix: upgrade to 2.1.0-7ubuntu0.16.04.5+esm2
|
| Ubuntu:16.04:LTS | canonical | ayttm | All versions |
| Ubuntu:16.04:LTS | canonical | cableswig | All versions |
| Ubuntu:16.04:LTS | canonical | cadaver | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | coin3 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | insighttoolkit | All versions |
| Ubuntu:16.04:LTS | canonical | insighttoolkit4 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | libxmltok |
< 1.2-3ubuntu0.16.04.1~esm2 Fix: upgrade to 1.2-3ubuntu0.16.04.1~esm2
|
| Ubuntu:16.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | swish-e | All versions |
| Ubuntu:16.04:LTS | canonical | tdom | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | vnc4 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | vtk | All versions |
| Ubuntu:16.04:LTS | canonical | wbxml2 | All versions |
| Ubuntu:16.04:LTS | canonical | xmlrpc-c | All versions |
| Ubuntu:18.04:LTS | canonical | expat |
< 2.2.5-3ubuntu0.4 Fix: upgrade to 2.2.5-3ubuntu0.4
|
| Ubuntu:18.04:LTS | canonical | firefox |
< 98.0+build3-0ubuntu0.18.04.2 Fix: upgrade to 98.0+build3-0ubuntu0.18.04.2
|
| Ubuntu:18.04:LTS | canonical | cadaver | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | coin3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | libxmltok |
< 1.2-4ubuntu0.18.04.1~esm4 Fix: upgrade to 1.2-4ubuntu0.18.04.1~esm4
|
| Ubuntu:18.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | swish-e | All versions |
| Ubuntu:18.04:LTS | canonical | tdom | All versions |
| Ubuntu:18.04:LTS | canonical | vnc4 | All versions |
| Ubuntu:18.04:LTS | canonical | wbxml2 | All versions |
| Ubuntu:18.04:LTS | canonical | xmlrpc-c | All versions |
| Ubuntu:20.04:LTS | canonical | expat |
< 2.2.9-1ubuntu0.2 Fix: upgrade to 2.2.9-1ubuntu0.2
|
| Ubuntu:20.04:LTS | canonical | firefox |
< 98.0+build3-0ubuntu0.20.04.2 Fix: upgrade to 98.0+build3-0ubuntu0.20.04.2
|
| Ubuntu:20.04:LTS | canonical | thunderbird |
< 1:91.11.0+build2-0ubuntu0.20.04.1 Fix: upgrade to 1:91.11.0+build2-0ubuntu0.20.04.1
|
| Ubuntu:20.04:LTS | canonical | cadaver | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | libxmltok |
< 1.2-4ubuntu0.20.04.1~esm4 Fix: upgrade to 1.2-4ubuntu0.20.04.1~esm4
|
| Ubuntu:20.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | swish-e | All versions |
| Ubuntu:20.04:LTS | canonical | tdom | All versions |
| Ubuntu:20.04:LTS | canonical | wbxml2 | All versions |
| Ubuntu:20.04:LTS | canonical | xmlrpc-c | All versions |
| Ubuntu:22.04:LTS | canonical | cadaver | All versions |
| Ubuntu:22.04:LTS | canonical | expat |
< 2.4.3-1 Fix: upgrade to 2.4.3-1
|
| Ubuntu:22.04:LTS | canonical | firefox |
< 1:1snap1-0ubuntu1 Fix: upgrade to 1:1snap1-0ubuntu1
|
| Ubuntu:22.04:LTS | canonical | matanza | All versions |
| Ubuntu:22.04:LTS | canonical | tdom | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird |
< 1:91.11.0+build2-0ubuntu0.22.04.1 Fix: upgrade to 1:91.11.0+build2-0ubuntu0.22.04.1
|
| Ubuntu:22.04:LTS | canonical | wbxml2 | All versions |
| Ubuntu:22.04:LTS | canonical | xmlrpc-c | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | libxmltok |
< 1.2-4ubuntu0.22.04.1~esm4 Fix: upgrade to 1.2-4ubuntu0.22.04.1~esm4
|
Showing 50 of 76. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:22.04:LTS | canonical | swish-e | All versions |
| Ubuntu:24.04:LTS | canonical | cadaver | All versions |
| Ubuntu:24.04:LTS | canonical | matanza | All versions |
| Ubuntu:24.04:LTS | canonical | tdom | All versions |
| Ubuntu:24.04:LTS | canonical | wbxml2 | All versions |
| Ubuntu:24.04:LTS | canonical | xmlrpc-c | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | libxmltok |
< 1.2-4.1ubuntu2.24.0.4.1+esm2 Fix: upgrade to 1.2-4.1ubuntu2.24.0.4.1+esm2
|
| Ubuntu:Pro:24.04:LTS | canonical | swish-e | All versions |
| Ubuntu:25.10 | canonical | cadaver | All versions |
| Ubuntu:25.10 | canonical | matanza | All versions |
| Ubuntu:25.10 | canonical | swish-e | All versions |
| Ubuntu:25.10 | canonical | tdom | All versions |
| Ubuntu:25.10 | canonical | wbxml2 | All versions |
| Ubuntu:25.10 | canonical | xmlrpc-c | All versions |
| Ubuntu:26.04 | canonical | cadaver | All versions |
| Ubuntu:26.04 | canonical | matanza | All versions |
| Ubuntu:26.04 | canonical | tdom | All versions |
| Ubuntu:26.04 | canonical | wbxml2 | All versions |
| Ubuntu:26.04 | canonical | xmlrpc-c | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | swish-e | All versions |
| – | libexpat_project | libexpat |
< 2.4.3 cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* |
| – | tenable | nessus |
< 8.15.3 >= 10.0.0, < 10.1.1 cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 11.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| – | siemens | sinema_remote_connect_server |
< 3.1 cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:* |
| Debian:12 | debian | expat |
< 2.4.3-1 Fix: upgrade to 2.4.3-1
|
| Debian:12 | debian | libxmltok | All versions |
Original advisory text
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
References
- https://ubuntu.com/security/CVE-2022-22826 Third Party Advisory
- https://github.com/libexpat/libexpat/pull/539 Third Party Advisory
- https://ubuntu.com/security/notices/USN-5288-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-5455-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-22826 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html URL
- https://cert-portal.siemens.com/productcert/html/ssa-484086.html URL
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22826... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-22826 Vendor Advisory
- https://security.gentoo.org/glsa/202209-24 Vendor Advisory
- https://www.tenable.com/security/tns-2022-05 URL
- https://www.debian.org/security/2022/dsa-5073 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/01/17/3 Third Party Advisory
- https://ubuntu.com/security/notices/USN-7199-1 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-22826 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-190Integer Overflow
Timeline
Published10 Jan 2022
Updated1 Nov 2026
First seen7 May 2026
Sources
UBUNTU-CVE-2022-22826 · OSV
CVE-2022-22826 · NVD
CVE-2022-22826 · MITRE
CVE-2022-22826 · OSV
DEBIAN-CVE-2022-22826 · OSV
Track software like this
Free during beta