Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-22826

30
FAUCET Score

CVE-2022-22826 is an integer overflow vulnerability in the nextScaffoldPart function of Expat (libexpat) versions prior to 2.4.3, impacting products from Debian, Siemens, and Tenable. This high-severity vulnerability (CVSS 8.8) can be exploited remotely with low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability if a user interaction is involved. While there is no evidence of active exploitation, public exploit code, or KEV listing, it has garnered some community discussion and media coverage, including a BleepingComputer article linking it to critical HP Teradici PCoIP flaws.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.4.3CPE matchmatch criteria
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
< 8.15.3CPE matchmatch criteria
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
>= 10.0.0, < 10.1.1CPE matchmatch criteria
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
11.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.80%
Probability of exploitation in next 30 days
EPSS Percentile
85.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0280 is in the 84th percentile among its peer group of 14,875 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (21)

microsoftpatch availablevia msrc
Product: 18813-16823Fixed in: 2.4.3-1
microsoftpatch availablevia msrc
Product: cbl2 expat 2.4.3-1 on CBL Mariner 2.0Fixed in: 2.4.3-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: expat-0:2.2.5-4.el8_5.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: xmlrpc-c-0:1.51.0-8.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: expat-0:2.2.10-1.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: expat-0:2.2.10-12.el9_0
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: expat
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: expat-0:2.1.0-14.el7_9
View patch
cephvendor investigatingvia llm_extracted
d-linkvendor investigatingvia llm_extracted
humansignalvendor investigatingvia llm_extracted
hyperledgervendor investigatingvia llm_extracted
m2teamvendor investigatingvia llm_extracted
roundcubevendor investigatingvia llm_extracted
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: firefox
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: firefox
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: thunderbird
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: thunderbird
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: xulrunner

Vendor Advisories (8)

m2teamllm-m2team-41bf9cb22f24a510CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
humansignalllm-humansignal-a731b4173ec8e579CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
d-linkllm-d-link-1b06970e59fff350CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
hyperledgerllm-hyperledger-3131efc9fc3bed9eCRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
roundcubellm-roundcube-8900788926ebda25CRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
cephllm-ceph-757e29f49fd4489eCRITICAL

Multiple ctrlX CORE vulnerabilities

Apr 20, 2022
redhatCVE-2022-22826Moderate

expat: Integer overflow in nextScaffoldPart in xmlparse.c

Jan 15, 2022
microsoft2022-Jan/CVE-2022-22826Important

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Jan 11, 2022

References

cert-portal.siemens.com / productcert/pdf/ssa-484086.pdf
PatchThird Party Advisory
github.com / libexpat/libexpat/pull/539
Third Party Advisory
security.gentoo.org / glsa/202209-24
Third Party Advisory
debian.org / security/2022/dsa-5073
Third Party Advisory
tenable.com / security/tns-2022-05
Third Party Advisory
openwall.com / lists/oss-security/2022/01/17/3
Mailing ListThird Party Advisory