CVE-2022-25235

33

FAUCET Score

CVE-2022-25235 is a critical vulnerability (CVSS 9.8) in Expat (libexpat) versions prior to 2.4.5, specifically in the xmltok_impl.c component, due to insufficient validation of UTF-8 encoding. This flaw can lead to severe impacts including complete compromise of confidentiality, integrity, and availability, affecting products from vendors like Debian, Fedora, Oracle, and Siemens. The attack vector is network-based with low complexity, requiring no user interaction or privileges. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 2.4.5CPE matchmatch criteria	cpe:2.3:a:libexpat_project:libexpat::::::::
		10.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:10.0:::::::*
		11.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:11.0:::::::*
		34CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:34:::::::*
		35CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:35:::::::*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

4.96%

Probability of exploitation in next 30 days

EPSS Percentile

91.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0495 is in the 85th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (48)

gcppatch availablevia llm_extracted

github_advisorypatch availablevia nvd_reference

microsoftpatch availablevia msrc

Product: 18787-16820Fixed in: 2.4.6-1

microsoftpatch availablevia msrc

Product: 18788-16823Fixed in: 2.4.8-1

microsoftpatch availablevia msrc

Product: cbl2 expat 2.4.8-1 on CBL Mariner 2.0Fixed in: 2.4.8-1

microsoftpatch availablevia msrc

Product: cm1 expat 2.4.6-1 on CBL Mariner 1.0Fixed in: 2.4.6-1

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: mingw-expat-0:2.4.8-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: expat-0:2.2.5-4.el8_5.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: firefox-0:91.7.0-3.el8_1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: thunderbird-0:91.7.0-2.el8_1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: expat-0:2.2.5-3.el8_1.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: xmlrpc-c-0:1.51.0-5.el8_1.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: firefox-0:91.7.0-3.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: thunderbird-0:91.7.0-2.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: expat-0:2.2.5-3.el8_2.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: xmlrpc-c-0:1.51.0-5.el8_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: firefox-0:91.7.0-3.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: thunderbird-0:91.7.0-2.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: expat-0:2.2.5-4.el8_4.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: xmlrpc-c-0:1.51.0-5.el8_4.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: expat-0:2.2.10-12.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-virtualization-host-0:4.3.22-20220330.1.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Fixed in: redhat-virtualization-host-0:4.4.10-202203211649_8.5

redhatpatch availablevia redhat_api

Product: Text-Only JBCSFixed in: expat

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: xmlrpc-c-0:1.51.0-5.el8_5.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 Extended Lifecycle SupportFixed in: expat-0:2.0.1-14.el6_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: firefox-0:91.7.0-3.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: thunderbird-0:91.7.0-2.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: expat-0:2.1.0-14.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: firefox-0:91.7.0-3.el8_5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: thunderbird-0:91.7.0-2.el8_5

ubuntupatch availablevia ubuntu_usn

Product: cableswig (xenial)Fixed in: 0.1.0+git20150808-2ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: insighttoolkit (xenial)Fixed in: 3.20.1+git20120521-6ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: swish-e (bionic)Fixed in: 2.4.7-5ubuntu1+esm1

ubuntupatch availablevia ubuntu_usn

Product: swish-e (focal)Fixed in: 2.4.7-6ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: swish-e (jammy)Fixed in: 2.4.7-6.1ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: swish-e (noble)Fixed in: 2.4.7-6.2ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: swish-e (resolute)Fixed in: 2.4.7-7.1ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: swish-e (xenial)Fixed in: 2.4.7-4ubuntu0.1~esm1

cephvendor investigatingvia llm_extracted

d-linkvendor investigatingvia llm_extracted

humansignalvendor investigatingvia llm_extracted

hyperledgervendor investigatingvia llm_extracted

m2teamvendor investigatingvia llm_extracted

roundcubevendor investigatingvia llm_extracted

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: firefox:flatpak/firefox

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: thunderbird:flatpak/thunderbird

Vendor Advisories (12)

ubuntuUSN-8316-1

CableSwig vulnerabilities

ubuntuUSN-8235-1

ITK vulnerabilities

ubuntuUSN-8240-1

Swish-e vulnerabilities

gcpllm-gcp-251ac0c885af6b4bCRITICAL

Certain HP LaserJet Enterprise and HP LaserJet Managed Printers – Potential Denial of Service & Potential Buffer Overflow

humansignalllm-humansignal-a731b4173ec8e579CRITICAL

Multiple ctrlX CORE vulnerabilities

m2teamllm-m2team-41bf9cb22f24a510CRITICAL

Multiple ctrlX CORE vulnerabilities

d-linkllm-d-link-1b06970e59fff350CRITICAL

Multiple ctrlX CORE vulnerabilities

hyperledgerllm-hyperledger-3131efc9fc3bed9eCRITICAL

Multiple ctrlX CORE vulnerabilities

roundcubellm-roundcube-8900788926ebda25CRITICAL

Multiple ctrlX CORE vulnerabilities

cephllm-ceph-757e29f49fd4489eCRITICAL

Multiple ctrlX CORE vulnerabilities

redhatCVE-2022-25235Important

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

microsoft2022-Feb/CVE-2022-25235

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding such as checks for whether a UTF-8 character is valid in a certain context.

References

cert-portal.siemens.com / productcert/pdf/ssa-484086.pdf

Third Party Advisory

github.com / libexpat/libexpat/pull/562

PatchThird Party Advisory

lists.debian.org / debian-lts-announce/2022/03/msg00007.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM

security.gentoo.org / glsa/202209-24

Third Party Advisory

security.netapp.com / advisory/ntap-20220303-0008

Third Party Advisory

debian.org / security/2022/dsa-5085

Third Party Advisory

oracle.com / security-alerts/cpuapr2022.html

PatchThird Party Advisory

openwall.com / lists/oss-security/2022/02/19/1

Mailing ListThird Party Advisory