Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-40303

38
FAUCET Score

CVE-2022-40303 is a high-severity vulnerability in libxml2 (versions prior to 2.10.3) that affects products from Apple, NetApp, and xmlsoft. It allows an unauthenticated attacker to trigger a denial-of-service (segmentation fault) by providing a specially crafted, multi-gigabyte XML document when the XML_PARSE_HUGE option is enabled. This is due to integer overflows leading to an attempt to access an array at a negative offset. While there are no known public exploits or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion and media coverage, with specific mentions of macOS Monterey remaining vulnerable.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.10.3CPE matchmatch criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:netapp_manageability_sdk:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
22.79%
Probability of exploitation in next 30 days
EPSS Percentile
97.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.2279 is in the 96th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (16)

bitdefenderpatch availablevia llm_extracted
Fixed in: ['9.0.2303.100']
View patch
cyberarkpatch availablevia llm_extracted
Fixed in: 2.10.3
ggerganovpatch availablevia llm_extracted
Fixed in: 2.10.3
halopatch availablevia llm_extracted
Fixed in: 2.10.3
intermeshpatch availablevia llm_extracted
Fixed in: 2.10.3
microsoftpatch availablevia msrc
Product: cbl2 libxml2 2.10.3-1 on CBL Mariner 2.0Fixed in: 2.10.3-1
microsoftpatch availablevia msrc
Product: 18540-16823Fixed in: 2.10.3-1
microsoftpatch availablevia msrc
Product: cm1 libxml2 2.9.14-3 on CBL Mariner 1.0Fixed in: 2.9.14-3
microsoftpatch availablevia msrc
Product: 16872-16820Fixed in: 2.9.14-3
nessuspatch availablevia llm_extracted
Fixed in: 2.10.3
opensipspatch availablevia llm_extracted
Fixed in: 2.10.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: libxml2-0:2.9.7-13.el8_6.4
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: libxml2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: libxml2-0:2.9.7-15.el8_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: libxml2-0:2.9.13-3.el9_1
View patch
vitejspatch availablevia llm_extracted
Fixed in: 2.10.3

Vendor Advisories (10)

bitdefenderllm-bitdefender-b23af70584e80d8cHIGH

June Third Party Package Updates in Splunk Cloud

Jun 1, 2023
microsoft2022-Nov/CVE-2022-40303Important

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset typically leading to a segmentation fault.

Nov 8, 2022
redhatCVE-2022-40303Moderate

libxml2: integer overflows with XML_PARSE_HUGE

Oct 14, 2022
intermeshllm-intermesh-4ab4d77ea4af1f99

libxml2 vulnerabilities

cyberarkllm-cyberark-7c7cc9522e9c06e0

libxml2 vulnerabilities (CVE-2022-40303, CVE-2022-40304)

ggerganovllm-ggerganov-64601fe5ae07161c

libxml2 vulnerabilities

halollm-halo-30340b64338c931e

libxml2 Vulnerabilities

opensipsllm-opensips-9b710000648073d3

libxml2 vulnerabilities resolved

vitejsllm-vitejs-c59efd5605fc95db

libxml2 vulnerabilities

nessusllm-nessus-5be7aeee0d3bb965

libxml2 vulnerabilities

References

seclists.org / fulldisclosure/2022/Dec/21
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/24
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/25
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/26
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/27
gitlab.gnome.org / GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0
PatchThird Party Advisory
gitlab.gnome.org / GNOME/libxml2/-/tags/v2.10.3
Release NotesThird Party Advisory
security.netapp.com / advisory/ntap-20221209-0003
Third Party Advisory
support.apple.com / kb/HT213531
Third Party Advisory
support.apple.com / kb/HT213533
Third Party Advisory
support.apple.com / kb/HT213534
Third Party Advisory
support.apple.com / kb/HT213535
Third Party Advisory
support.apple.com / kb/HT213536
Third Party Advisory