CVE-2022-22825

HIGH 8.8CVE-2022-22825 · Published 10/01/2022 · updated 14/10/2026

In short

CVE-2022-22825 is a HIGH (CVSS 8.8) vulnerability affecting libexpat (libexpat project), sinema remote connect server (siemens), nessus (tenable).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.3% of all vulnerabilities.
Fix: update to 2.4.3, 3.1, 10.1.1, 8.15.3 or later.

Package	Affected versions	Patched versions
libexpat libexpat_project	`< 2.4.3`	`2.4.3`
sinema remote connect server siemens	`< 3.1`	`3.1`
nessus tenable	`≥ 10.0.0, < 10.1.1< 8.15.3`	`10.1.18.15.3`

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 2.4.3

2.4.3

< 3.1

3.1

≥ 10.0.0, < 10.1.1< 8.15.3

10.1.18.15.3

More vulnerabilities in libexpat

See all →