CVE-2022-43680 json
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD...
published 2022-10-24 4 y ago modified 2026-10-14 25 d ago also EUVD-2022-46673 , JLSEC-2025-58
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
Patch / fix
- julia Expat_jll 2.5.0+0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- expat Debian 14, Debian 13, Debian 12 2.5.0-1
debian advisories DEBIAN-CVE-2022-43680
- expat Ubuntu 18.04 LTS 2.2.5-3ubuntu0.8
- expat Ubuntu 20.04 LTS 2.2.9-1ubuntu0.6
- expat Ubuntu 22.04 LTS 2.4.7-1ubuntu0.2
- expat Ubuntu Pro 14.04 LTS 2.1.0-4ubuntu1.4+esm7
- expat Ubuntu Pro 16.04 LTS 2.1.0-7ubuntu0.16.04.5+esm7
ubuntu advisories UBUNTU-CVE-2022-43680
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- firefox RHEL 8 102.5.0-1.el8_7
- expat RHEL 9 2.4.9-1.el9_1.1
- expat RHEL 8 2.2.5-10.el8_7.1
- expat RHEL 8.2 AUS 2.2.10-1.el8_2
- expat RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 2.2.10-1.el8_4
- firefox RHEL 8.1 E4S 102.5.0-1.el8_1
- firefox RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 102.5.0-1.el8_2
- firefox RHEL 8.4 EUS 102.5.0-1.el8_4
red hat advisories RHSA-2025:22871RHSA-2025:22785RHSA-2022:8553RHSA-2022:8554RHSA-2022:8550RHSA-2022:8549
- expat Linux Micro 6.0 2.8.5-159998.1.1
- expat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 2.8.5-150400.3.40.1
- expat SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +21 more 2.2.5-150000.3.25.1
- expat SLE Module for Basesystem 15 SP4, SLE Micro 5.3, openSUSE Leap 15.4 2.4.4-150400.3.12.1
- expat SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 2.1.0-21.28.1
- expat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.8.5-21.55.1
suse advisories SUSE-SU-2026:24323-1SUSE-SU-2026:4623-1SUSE-SU-2026:4615-1SUSE-SU-2022:3912-1SUSE-SU-2022:3884-1SUSE-SU-2022:3874-1
- expat openSUSE Tumbleweed 2.5.0-1.1
opensuse advisories openSUSE-SU-2024:12449-1
- expat AlmaLinux 9 2.4.9-1.el9_1.1
- expat AlmaLinux 8 2.2.5-10.el8_7.1
almalinux advisories ALSA-2023:0337ALSA-2023:0103
- expat Rocky Linux 9 2.4.9-1.el9_1.1
- expat Rocky Linux 8 2.2.5-10.el8_7.1
rocky linux advisories RLSA-2023:0337RLSA-2023:0103
- expat Alpine 3.13 2.2.10-r8
- expat Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 2.5.0-r0
alpine advisories ALPINE-CVE-2022-43680
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/libexpat/libexpat#650 pull request
- github.com/libexpat/libexpat#616 pull request
- github.com/libexpat/libexpat/issues/649 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-43680 updated cvss 7.5
expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
-
Red Hat Enterprise Linux 6 expat, compat-expat1affected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 7 expat, firefox, thunderbirdaffected: no fix available, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 8 firefox, thunderbirdaffected: no fix available, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 9 firefox, firefox-x11, thunderbirdaffected: no fix available
-
Red Hat JBCS httpd 2.4.51.sp2fixed: vendor fix RHSA-2023:3355
-
Red Hat Enterprise Linux AppStream (v. 8) firefox 102.5.0-1.el8_7fixed: vendor fix RHSA-2022:8554
-
Red Hat Enterprise Linux AppStream (v. 9) expat-devel 2.4.9-1.el9_1.1, expat-debuginfo 2.4.9-1.el9_1.1, expat-debugsource 2.4.9-1.el9_1.1fixed: vendor fix RHSA-2023:0337
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox 102.5.0-1.el8_2fixed: vendor fix RHSA-2022:8550
show 12 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) firefox 102.5.0-1.el8_1fixed: vendor fix RHSA-2022:8553
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) firefox 102.5.0-1.el8_2fixed: vendor fix RHSA-2022:8550
-
Red Hat Enterprise Linux AppStream EUS (v.8.4) firefox 102.5.0-1.el8_4fixed: vendor fix RHSA-2022:8549
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) firefox 102.5.0-1.el8_6fixed: vendor fix RHSA-2022:8548
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) firefox 102.5.0-1.el8_2fixed: vendor fix RHSA-2022:8550
-
Red Hat Enterprise Linux BaseOS (v. 8) expat 2.2.5-10.el8_7.1fixed: vendor fix RHSA-2023:0103
-
Red Hat Enterprise Linux BaseOS (v. 9) expat 2.4.9-1.el9_1.1fixed: vendor fix RHSA-2023:0337
-
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat 2.2.10-1.el8_2fixed: vendor fix RHSA-2025:22871
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) expat 2.2.10-1.el8_4fixed: vendor fix RHSA-2025:22785
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) expat 2.2.5-8.el8_6.4fixed: vendor fix RHSA-2024:0421
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) expat 2.2.10-1.el8_4fixed: vendor fix RHSA-2025:22785
-
Red Hat Enterprise Linux 8 xmlrpc-c, xmlrpc-c-c++, xmlrpc-c-client, xmlrpc-c-client++ Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat 2.2.10-1.el8_2 Red Hat Enterprise Linux BaseOS AUS (v.8.4) expat 2.2.10-1.el8_4 Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) expat 2.2.10-1.el8_4not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 7.5
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-131-05 updated cvss 7.5
Siemens SINEC NMS Third-Party
-
Siemens SINEC NMS <V1.0.3.1affected: fixed in V1.0.3.1 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-143-01 updated cvss 7.5
Hitachi Energy’s AFS65x, AFS67x, AFR67x and AFF66x Products
-
Hitachi Energy AFF660/665 <= 03.0.02affected: vendor fix search.abb.com
-
Hitachi Energy AFR67x <= 9.1.07affected: fixed in 9.1.08 search.abb.com
-
Hitachi Energy AFS65x Hitachi Energy AFS660/665C <= 7.1.05 Hitachi Energy AFS660/665S <= 7.1.05affected: vendor fix search.abb.com
-
Hitachi Energy AFS670/675 <= 9.1.07affected: fixed in 9.1.08 search.abb.com
-
Hitachi Energy AFS670v2 <= 7.1.05affected: vendor fix search.abb.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/libexpat/libexpat/pull/650 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/libexpat/libexpat/pull/616 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/libexpat/libexpat/issues/649 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | Expat_jll | <2.5.0+0 |
2.5.0+0 |
Affected products
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
github.com
/libexpat/libexpat/pull/650
exploit, issue-tracking, patch, third-party-advisory, web
-
github.com
/libexpat/libexpat/pull/616
exploit, issue-tracking, patch, third-party-advisory, web
-
github.com
/libexpat/libexpat/issues/649
exploit, issue-tracking, patch, third-party-advisory, web
-
debian.org
/security/2022/dsa-5266
vendor-advisory, third-party-advisory, web
-
security.gentoo.org
/glsa/202210-38
vendor-advisory, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/
vendor-advisory, mailing-list, third-party-advisory, web
-
lists.debian.org
/debian-lts-announce/2022/10/msg00033.html
mailing-list, third-party-advisory, web
-
security.netapp.com
/advisory/ntap-20221118-0007/
third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/12/28/5
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2024/01/03/5
mailing-list, third-party-advisory, web
- cert-portal.siemens.com /productcert/html/ssa-892048.html
- cert-portal.siemens.com /productcert/html/ssa-398330.html
Sources
- CVE List CVE-2022-43680
- NVD CVE-2022-43680
- OSV JLSEC-2025-58
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.