External risk intelligence

Expat XML Parser Integer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-23852

libexpat is a widely used low-level XML parsing library embedded within many diverse applications, ranging from local utilities and internal system tools to public-facing network services and web applications. Because it is a dependency, its exposure depends entirely on the host application's function. While it is commonly used in network-connected software, it is not inherently a public-facing service itself.

Integer Overflow

Libexpat Project Libexpat

before 2.4.4before 8.15.310.0.0 to before 10.1.16.3.19.0before 3.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Expat XML parsing library, which is a component used in various software. This issue could potentially allow for significant compromise of systems if exploited, impacting confidentiality, integrity, and availability. The main concern is confirming the relevance and exposure of this library within our technology stack.

Flaw in common XML reader affects many systems.
Matters because widespread use means potential broad impact.
Assess exposure and confirm relevance in our environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending a specially crafted XML file to an application that uses a vulnerable version of the Expat library. This library is often integrated into other software, meaning the attacker doesn't necessarily need direct access to Expat itself, but rather to an application that relies on it. Successful triggering could lead to a denial-of-service or potentially impact the confidentiality and integrity of data processed by the application.

Entry condition: Application processes XML via Expat.
Trigger point: Inputting crafted XML to `XML_GetBuffer`.
Resulting risk: Denial of service or data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect systems processing XML data when using affected versions of Expat. An attacker could potentially trigger an integer overflow when parsing specially crafted XML, leading to unexpected behavior or crashes.

XML data processing
Integer overflow during parsing
Service instability or crashes

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability likely falls on teams managing applications that incorporate Expat, such as infrastructure, platform, or application owners. The initial practical step is to locate all instances of Expat within your environment, assess their reachability and business criticality, and then identify the accountable owner for each instance to plan a risk-based remediation.

Application owners should confirm Expat usage.
Verify Expat instances are reachable and critical.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libexpat and why is it in so many software products?

Libexpat is a foundational, open-source C library designed to parse XML documents. Developers frequently embed it into larger applications, such as databases, network scanners, and web services, because it provides a reliable, high-performance way to interpret structured XML data. Since it acts as an underlying engine for processing data formats, it is a common dependency across a vast range of enterprise and open-source software.

How does a signed integer overflow vulnerability work in CVE-2022-23852?

This vulnerability is classified as CWE-190, where a calculation error occurs when the library attempts to allocate memory. Specifically, it happens during a mathematical operation that exceeds the capacity of the storage type. When this integer overflow is triggered within the XML_GetBuffer function, the library may perform an incorrect memory allocation, which can cause the application to crash or behave in ways that compromise data integrity.

Do I need to send data to the application to trigger this flaw?

Yes, an attacker must typically provide a specially crafted XML input to the vulnerable application. If the application configuration does not use the specific XML_CONTEXT_BYTES setting, the trigger path for this integer overflow may not be active. Simply having the library installed is not enough; the software must actively process an incoming, malicious XML payload using the specific vulnerable code path within libexpat.

Is my system at risk if I use software that relies on libexpat?

Halo Surface Signal notes that libexpat's risk depends entirely on the host application. If an application using a vulnerable version faces the public internet and processes external XML data, the potential for attack is higher. Conversely, if the software is restricted to internal use only and does not process untrusted XML input, the likelihood of an attacker reaching this code path is significantly reduced.

How should I begin addressing this CVE in my environment?

Start by auditing your software inventory to identify which applications include libexpat versions older than 2.4.4. Since this library is often a hidden dependency, you may need to check dependency manifests or binary inclusions. Once located, prioritize these instances based on their network accessibility and the sensitivity of the data they process to plan your update schedule.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.