External risk intelligence

Expat XML Parser Integer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-22823

Libexpat is a widely used low-level XML parsing library integrated into numerous software products, operating systems, and applications. While it is often embedded within internal application logic, it can be reachable via network-facing interfaces that process XML input. Because it is a dependency rather than a standalone edge service, public exposure depends heavily on the specific host application's implementation.

Integer Overflow

Libexpat Project Libexpat

before 2.4.3before 8.15.310.0.0 to before 10.1.110.011.0before 3.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Expat XML parsing library, specifically an integer overflow, could allow for significant impacts. While Expat is a foundational component used across many systems, its direct exposure often depends on how specific applications handle XML data. The main concern is confirming whether systems processing external XML are affected.

Integer overflow in common XML parser.
Widely used library, potential for broad impact.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending specially crafted XML data to an application that uses a vulnerable version of the Expat XML parsing library. This exposure is possible because the library is often integrated into software that processes data received over a network. If the vulnerable `build_model` function in Expat receives malicious input, it can lead to an integer overflow, potentially allowing an attacker to compromise the integrity and availability of the affected application.

Network access to XML processing.
Specially crafted XML input.
Uncontrolled application execution and crashes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the XML parsing library could allow an attacker to cause a denial-of-service condition or potentially affect the integrity of data when processing specially crafted XML data. The exact impact depends on how and where the library is used by the affected application.

XML data integrity and availability.
Malicious XML input processing.
Application crashes or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The "build_model" vulnerability in Expat (libexpat) affects applications that parse XML. Ownership typically falls to the application or platform teams responsible for managing the software that embeds Expat, with potential coordination needed from infrastructure and security teams. The first practical step is to identify all systems running affected software, confirm exposure through XML processing, and ascertain business criticality to prioritize remediation.

Application and platform teams own this.
Verify XML processing exposure and criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libexpat and why is it used?

Libexpat is a low-level, open-source C library designed for parsing XML files. Developers integrate it into various software products, operating systems, and applications to enable them to read, interpret, and process XML data structures efficiently. Because it acts as a foundational dependency, many different programs rely on it to handle structured information automatically.

What does an integer overflow mean for CVE-2022-22823?

This vulnerability is classified as an integer overflow (CWE-190). In this case, the `build_model` function in Expat fails to handle extremely large or specifically structured numerical values during the parsing process. When these numbers exceed the library's capacity, it can cause memory errors, potentially leading to application crashes or unauthorized data manipulation.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted XML data to an application that uses a vulnerable version of libexpat. The vulnerability exists within the library's internal logic, meaning it does not trigger if the application is not actively processing XML input from an untrusted source or if the library is not used in the application's data-handling flow.

Is my system at risk for CVE-2022-22823?

Risk depends on your specific host application, not just the library version. Halo Surface Signal notes that because libexpat is an embedded dependency rather than a standalone service, public exposure varies. Systems that use libexpat to process XML data received over a network are generally higher priority than those handling only local or trusted input.

What should I do if I use affected software?

Start by identifying all systems in your environment that rely on libexpat. Verify which of these applications process external XML data, as these are the primary targets. Coordinate with your application or platform teams to prioritize updates for those systems, especially those that are internet-facing or handle untrusted data, to ensure they move to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.