Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-22824

33
FAUCET Score

CVE-2022-22824 is a critical integer overflow vulnerability in the Expat XML parser (libexpat) affecting versions prior to 2.4.3, specifically within the defineAttribute function in xmlparse.c. This flaw impacts various products, including Debian, Siemens, and Tenable, and has a CVSS score of 9.8, indicating a severe risk. The vulnerability allows for unauthenticated, low-complexity network attacks that can lead to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, notably regarding its impact on HP Teradici PCoIP endpoints.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.4.3CPE matchmatch criteria
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
< 8.15.3CPE matchmatch criteria
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
>= 10.0.0, < 10.1.1CPE matchmatch criteria
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
11.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.40%
Probability of exploitation in next 30 days
EPSS Percentile
87.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0340 is in the 80th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 18813-16823Fixed in: 2.4.3-1
microsoftpatch availablevia msrc
Product: cbl2 expat 2.4.3-1 on CBL Mariner 2.0Fixed in: 2.4.3-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: firefox-0:91.7.0-3.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: expat-0:2.1.0-14.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: firefox-0:91.7.0-3.el8_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: thunderbird-0:91.7.0-2.el8_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: expat-0:2.2.5-4.el8_5.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: xmlrpc-c-0:1.51.0-8.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: expat-0:2.2.10-1.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: expat-0:2.2.10-12.el9_0
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: expat
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: thunderbird-0:91.7.0-2.el7_9
View patch
cephvendor investigatingvia llm_extracted
d-linkvendor investigatingvia llm_extracted
humansignalvendor investigatingvia llm_extracted
hyperledgervendor investigatingvia llm_extracted
m2teamvendor investigatingvia llm_extracted
roundcubevendor investigatingvia llm_extracted
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: xulrunner

Vendor Advisories (8)

m2teamllm-m2team-41bf9cb22f24a510CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
humansignalllm-humansignal-a731b4173ec8e579CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
d-linkllm-d-link-1b06970e59fff350CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
hyperledgerllm-hyperledger-3131efc9fc3bed9eCRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
roundcubellm-roundcube-8900788926ebda25CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
cephllm-ceph-757e29f49fd4489eCRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
redhatCVE-2022-22824Important

expat: Integer overflow in defineAttribute in xmlparse.c

Jan 15, 2022
microsoft2022-Jan/CVE-2022-22824Critical

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Jan 11, 2022

References

cert-portal.siemens.com / productcert/pdf/ssa-484086.pdf
PatchThird Party Advisory
github.com / libexpat/libexpat/pull/539
PatchThird Party Advisory
security.gentoo.org / glsa/202209-24
Third Party Advisory
debian.org / security/2022/dsa-5073
Third Party Advisory
tenable.com / security/tns-2022-05
Third Party Advisory
openwall.com / lists/oss-security/2022/01/17/3
Mailing ListThird Party Advisory