Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-22822

33
FAUCET Score

CVE-2022-22822 is a critical integer overflow vulnerability in the addBinding function of xmlparse.c within Expat (libexpat) versions prior to 2.4.3, affecting products from vendors like Debian, Siemens, and Tenable. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.4.3CPE matchmatch criteria
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
< 8.15.3CPE matchmatch criteria
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
>= 10.0.0, < 10.1.1CPE matchmatch criteria
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
< 3.1CPE matchmatch criteria
cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.83%
Probability of exploitation in next 30 days
EPSS Percentile
91.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0483 is in the 85th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 18813-16823Fixed in: 2.4.3-1
microsoftpatch availablevia msrc
Product: cbl2 expat 2.4.3-1 on CBL Mariner 2.0Fixed in: 2.4.3-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: firefox-0:91.7.0-3.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: expat-0:2.1.0-14.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: firefox-0:91.7.0-3.el8_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: thunderbird-0:91.7.0-2.el8_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: expat-0:2.2.5-4.el8_5.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: xmlrpc-c-0:1.51.0-8.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: expat-0:2.2.10-1.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: expat-0:2.2.10-12.el9_0
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: expat
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: thunderbird-0:91.7.0-2.el7_9
View patch
cephvendor investigatingvia llm_extracted
d-linkvendor investigatingvia llm_extracted
humansignalvendor investigatingvia llm_extracted
hyperledgervendor investigatingvia llm_extracted
m2teamvendor investigatingvia llm_extracted
roundcubevendor investigatingvia llm_extracted
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: xulrunner

Vendor Advisories (8)

m2teamllm-m2team-41bf9cb22f24a510CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
humansignalllm-humansignal-a731b4173ec8e579CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
d-linkllm-d-link-1b06970e59fff350CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
hyperledgerllm-hyperledger-3131efc9fc3bed9eCRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
roundcubellm-roundcube-8900788926ebda25CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
cephllm-ceph-757e29f49fd4489eCRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
redhatCVE-2022-22822Important

expat: Integer overflow in addBinding in xmlparse.c

Jan 15, 2022
microsoft2022-Jan/CVE-2022-22822Critical

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Jan 11, 2022

References

cert-portal.siemens.com / productcert/pdf/ssa-484086.pdf
PatchThird Party Advisory
github.com / libexpat/libexpat/pull/539
PatchThird Party Advisory
security.gentoo.org / glsa/202209-24
Third Party Advisory
debian.org / security/2022/dsa-5073
Third Party Advisory
tenable.com / security/tns-2022-05
Third Party Advisory
openwall.com / lists/oss-security/2022/01/17/3
Mailing ListRelease NotesThird Party Advisory