Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-40304

27
FAUCET Score

CVE-2022-40304 is a high-severity vulnerability in libxml2 versions prior to 2.10.3, affecting products like Apple and NetApp. Invalid XML entity definitions can corrupt a hash table key, potentially leading to logic errors and a double-free condition. This vulnerability has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability, with a low attack complexity requiring user interaction. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, suggesting awareness among researchers.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.10.3CPE matchmatch criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
6.78%
Probability of exploitation in next 30 days
EPSS Percentile
93.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0678 is in the 94th percentile among its peer group of 11,616 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (16)

bitdefenderpatch availablevia llm_extracted
Fixed in: ['9.0.2303.100']
View patch
cyberarkpatch availablevia llm_extracted
Fixed in: 2.10.3
ggerganovpatch availablevia llm_extracted
Fixed in: 2.10.3
halopatch availablevia llm_extracted
Fixed in: 2.10.3
intermeshpatch availablevia llm_extracted
Fixed in: 2.10.3
microsoftpatch availablevia msrc
Product: cbl2 libxml2 2.10.3-1 on CBL Mariner 2.0Fixed in: 2.10.3-1
microsoftpatch availablevia msrc
Product: 18540-16823Fixed in: 2.10.3-1
microsoftpatch availablevia msrc
Product: cm1 libxml2 2.9.14-3 on CBL Mariner 1.0Fixed in: 2.9.14-3
microsoftpatch availablevia msrc
Product: 16872-16820Fixed in: 2.9.14-3
nessuspatch availablevia llm_extracted
Fixed in: 2.10.3
opensipspatch availablevia llm_extracted
Fixed in: 2.10.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: libxml2-0:2.9.7-13.el8_6.4
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: libxml2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: libxml2-0:2.9.7-15.el8_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: libxml2-0:2.9.13-3.el9_1
View patch
vitejspatch availablevia llm_extracted
Fixed in: 2.10.3

Vendor Advisories (10)

bitdefenderllm-bitdefender-b23af70584e80d8cHIGH

June Third Party Package Updates in Splunk Cloud

Jun 1, 2023
microsoft2022-Nov/CVE-2022-40304Important

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key potentially leading to subsequent logic errors. In one case a double-free can be provoked.

Nov 8, 2022
redhatCVE-2022-40304Moderate

libxml2: dict corruption caused by entity reference cycles

Oct 14, 2022
intermeshllm-intermesh-4ab4d77ea4af1f99

libxml2 vulnerabilities

cyberarkllm-cyberark-7c7cc9522e9c06e0

libxml2 vulnerabilities (CVE-2022-40303, CVE-2022-40304)

ggerganovllm-ggerganov-64601fe5ae07161c

libxml2 vulnerabilities

halollm-halo-30340b64338c931e

libxml2 Vulnerabilities

opensipsllm-opensips-9b710000648073d3

libxml2 vulnerabilities resolved

vitejsllm-vitejs-c59efd5605fc95db

libxml2 vulnerabilities

nessusllm-nessus-5be7aeee0d3bb965

libxml2 vulnerabilities

References

seclists.org / fulldisclosure/2022/Dec/21
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/24
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/25
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/26
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/Dec/27
gitlab.gnome.org / GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b
PatchThird Party Advisory
gitlab.gnome.org / GNOME/libxml2/-/tags
Release NotesThird Party Advisory
gitlab.gnome.org / GNOME/libxml2/-/tags/v2.10.3
PatchRelease NotesThird Party Advisory
security.netapp.com / advisory/ntap-20221209-0003
Third Party Advisory
support.apple.com / kb/HT213531
Third Party Advisory
support.apple.com / kb/HT213533
Third Party Advisory
support.apple.com / kb/HT213534
Third Party Advisory
support.apple.com / kb/HT213535
Third Party Advisory
support.apple.com / kb/HT213536
Third Party Advisory