Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2022-25235

critical

CVE-2022-25235

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

Published Modified CWE 116
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Amazon, CBL-Mariner, Julia, Photon OS. Rated lower by Red Hat (high), AlmaLinux (high), Bottlerocket (high), Oracle (high), Rocky Linux (high), Ubuntu (high).

Description

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Affected packages and fixed versions

SourcePackageFixed in
amazon linux 1expat, expat-debuginfo, expat-devel and 7 more2.1.0-12.27.amzn1 and 1 more
amazon linux 2expat, expat-debuginfo, expat-devel and 10 more2.1.0-12.amzn2.0.3 and 2 more
amazon linux 2022expat, expat-debuginfo, expat-debugsource and 14 more2.4.7-1.amzn2022.0.1 and 1 more
amazon linux 2023expat, expat-debuginfo, expat-debugsource and 14 more2.5.0-1.amzn2023.0.2 and 1 more
CBL-Mariner 1.0expat0:2.4.6-1.cm1
CBL-Mariner 2.0expat0:2.4.8-1.cm2
julia::Julia Ecosystem Security AdvisoriesExpat_jll2.4.8+0
Photon OS 1.0expat2.2.9-6.ph1
Photon OS 2.0expat2.2.9-6.ph2
Photon OS 3.0expat2.2.9-7.ph3
Photon OS 4.0expat, expat-devel, expat-docs and 1 more2.2.9-7.ph4
alma 8expat, expat-devel, firefox and 6 more2.2.5-8.el8_6.2 and 4 more
Show all 195 entries from 68 sources
SourcePackageFixed in
amazon linux 1expat2.1.0-12.27.amzn1
amazon linux 1expat-debuginfo2.1.0-12.27.amzn1
amazon linux 1expat-devel2.1.0-12.27.amzn1
amazon linux 1xmlrpc-c1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-apps1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-c++1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-client1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-client++1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-debuginfo1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-devel1.22.04-r1934.7.amzn1
amazon linux 2expat2.1.0-12.amzn2.0.3
amazon linux 2expat-debuginfo2.1.0-12.amzn2.0.3
amazon linux 2expat-devel2.1.0-12.amzn2.0.3
amazon linux 2expat-static2.1.0-12.amzn2.0.3
amazon linux 2thunderbird91.7.0-2.amzn2.0.1
amazon linux 2thunderbird-debuginfo91.7.0-2.amzn2.0.1
amazon linux 2xmlrpc-c1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-apps1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-c++1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-client1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-client++1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-debuginfo1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-devel1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2022expat2.4.7-1.amzn2022.0.1
amazon linux 2022expat-debuginfo2.4.7-1.amzn2022.0.1
amazon linux 2022expat-debugsource2.4.7-1.amzn2022.0.1
amazon linux 2022expat-devel2.4.7-1.amzn2022.0.1
amazon linux 2022expat-static2.4.7-1.amzn2022.0.1
amazon linux 2022xmlrpc-c1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-apps1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-apps-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-c++1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-c++-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client++1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client++-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-debugsource1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-devel1.51.0-12.amzn2022.0.2
amazon linux 2023expat2.5.0-1.amzn2023.0.2
amazon linux 2023expat-debuginfo2.5.0-1.amzn2023.0.2
amazon linux 2023expat-debugsource2.5.0-1.amzn2023.0.2
amazon linux 2023expat-devel2.5.0-1.amzn2023.0.2
amazon linux 2023expat-static2.5.0-1.amzn2023.0.2
amazon linux 2023xmlrpc-c1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-apps1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-apps-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-c++1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-c++-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client++1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client++-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-debugsource1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-devel1.51.08-2.amzn2023.0.1
CBL-Mariner 1.0expat0:2.4.6-1.cm1
CBL-Mariner 2.0expat0:2.4.8-1.cm2
julia::Julia Ecosystem Security AdvisoriesExpat_jll2.4.8+0
Photon OS 1.0expat2.2.9-6.ph1
Photon OS 2.0expat2.2.9-6.ph2
Photon OS 3.0expat2.2.9-7.ph3
Photon OS 4.0expat2.2.9-7.ph4
Photon OS 4.0expat-devel2.2.9-7.ph4
Photon OS 4.0expat-docs2.2.9-7.ph4
Photon OS 4.0expat-libs2.2.9-7.ph4
alma 8expat2.2.5-8.el8_6.2
alma 8expat-devel2.2.5-8.el8_6.2
alma 8firefox91.7.0-3.el8_5.alma
alma 8mingw32-expat2.4.8-1.el8
alma 8mingw64-expat2.4.8-1.el8
alma 8thunderbird91.7.0-2.el8_5.alma
alma 8xmlrpc-c-c++1.51.0-5.el8_5.1
alma 8xmlrpc-c-client++1.51.0-5.el8_5.1
alma 8xmlrpc-c-devel1.51.0-5.el8_5.1
alpine 3.12expat2.2.10-r2
alpine 3.13expat2.2.10-r4
alpine 3.14expat2.4.5-r0
alpine 3.15expat2.4.5-r0
alpine 3.16expat2.4.5-r0
alpine 3.17expat2.4.5-r0
alpine 3.18expat2.4.5-r0
alpine 3.19expat2.4.5-r0
alpine 3.20expat2.4.5-r0
alpine 3.21expat2.4.5-r0
alpine 3.22expat2.4.5-r0
alpine 3.23expat2.4.5-r0
alpine 3.24expat2.4.5-r0
alpine edgeexpat2.4.5-r0
bottlerocketlibexpat1.7.0-bf3ca665
debian 10expat2.2.6-2+deb10u3
debian 11expat2.2.10-2+deb11u2
debian 11libxmltokno fix listed
debian 12expat2.4.5-1
debian 12libxmltokno fix listed
debian 13expat2.4.5-1
debian 14expat2.4.5-1
debian 9expat2.2.0-2+deb9u5
echoexpat2.4.5-1
echolibxmltokno fix listed
Oracle Linux 6expat2.0.1-13.0.1.el6_8
Oracle Linux 6expat-devel2.0.1-13.0.1.el6_8
Oracle Linux 7expat2.1.0-14.0.1.el7_9
Oracle Linux 7expat-devel2.1.0-14.0.1.el7_9
Oracle Linux 7expat-static2.1.0-14.0.1.el7_9
Oracle Linux 7firefox91.7.0-3.0.1.el7_9
Oracle Linux 7thunderbird91.7.0-2.0.1.el7_9
Oracle Linux 8expat2.2.5-4.el8_5.3
Oracle Linux 8expat-devel2.2.5-4.el8_5.3
Oracle Linux 8firefox91.7.0-3.0.1.el8_5
Oracle Linux 8thunderbird91.7.0-2.0.1.el8_5
Oracle Linux 8xmlrpc-c1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-c++1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-client1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-client++1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-devel1.51.0-5.el8_5.1
rapidfort debian 12libxmltok0:1.2-4.1
rapidfort debian 13libxmltok0:1.2-4.1
rapidfort ubuntu 20.04matanzano fix listed
rapidfort ubuntu 20.04swish-eno fix listed
rapidfort ubuntu 20.04thunderbirdno fix listed
rapidfort ubuntu 22.04matanzano fix listed
rapidfort ubuntu 22.04swish-eno fix listed
rapidfort ubuntu 22.04thunderbirdno fix listed
rapidfort ubuntu 24.04matanzano fix listed
rapidfort ubuntu 24.04swish-eno fix listed
rapidfort ubuntu 24.04thunderbirdno fix listed
Red Hatfirefox:flatpak::firefoxno fix listed
Red Hatthunderbird:flatpak::thunderbirdno fix listed
rocky 8expat2.2.5-4.el8_5.3
rocky 8expat-devel2.2.5-4.el8_5.3
rocky 8firefox91.7.0-3.el8_5
rocky 8thunderbird91.7.0-2.el8_5
rocky 8xmlrpc-c1.51.0-5.el8_5.1
rocky 8xmlrpc-c-client1.51.0-5.el8_5.1
root.io debian 11rootio-expat2.2.10-2+deb11u2
root.io debian 12rootio-expat2.4.5-1
root.io debian 13rootio-expat2.4.5-1
seal debianexpat2.2.10-2+deb11u5+sp999
seal debianseal-expat2.2.10-2+deb11u5+sp999
seal Red Hat 6expat2.0.1-15.el6_10+sp999
seal Red Hat 6seal-expat2.0.1-15.el6_10+sp999
seal Red Hat 7expat2.1.0-15.el7_9+sp999
seal Red Hat 7seal-expat2.1.0-15.el7_9+sp999
seal Red Hat 8expat2.2.5-16.el8_10+sp999, 2.2.5-4.0.1.el8_5.3+sp999
seal Red Hat 8seal-expat2.2.5-16.el8_10+sp999, 2.2.5-4.0.1.el8_5.3+sp999
ubuntu 14.04-ESMexpat2.1.0-4ubuntu1.4+esm4
ubuntu 16.04-ESMcoin33.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
ubuntu 16.04-ESMexpat2.1.0-7ubuntu0.16.04.5+esm2
ubuntu 16.04-ESMinsighttoolkit3.20.1+git20120521-6ubuntu0.1~esm1
ubuntu 16.04-ESMlibxmltok1.2-3ubuntu0.16.04.1~esm2
ubuntu 16.04-ESMswish-e2.4.7-4ubuntu0.1~esm1
ubuntu 18.04expat2.2.5-3ubuntu0.4
ubuntu 18.04-ESMcoin33.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
ubuntu 18.04-ESMexpat2.2.5-3ubuntu0.4
ubuntu 18.04-ESMlibxmltok1.2-4ubuntu0.18.04.1~esm1
ubuntu 18.04-ESMswish-e2.4.7-5ubuntu1+esm1
ubuntu 18.04-ESMxmlrpc-c1.33.14-8ubuntu0.18.04.1~esm1
ubuntu 20.04expat2.2.9-1ubuntu0.2
ubuntu 20.04-ESMexpat2.2.9-1ubuntu0.2
ubuntu 20.04-ESMlibxmltok1.2-4ubuntu0.20.04.1~esm1
ubuntu 20.04-ESMswish-e2.4.7-6ubuntu0.1~esm1
ubuntu 20.04-ESMxmlrpc-c1.33.14-8ubuntu0.20.04.1~esm1
ubuntu 21.10expat2.4.1-2ubuntu0.1
ubuntu 22.04expat2.4.5-2
ubuntu 22.04firefox1:1snap1-0ubuntu1
ubuntu 22.04libxmltokno fix listed
ubuntu 22.04swish-eno fix listed
ubuntu 22.04xmlrpc-cno fix listed
ubuntu 22.10expat2.4.5-2
ubuntu 22.10firefox1:1snap1-0ubuntu1
ubuntu 23.04expat2.4.5-2
ubuntu 23.04firefox1:1snap1-0ubuntu1
ubuntu 23.10expat2.4.5-2
ubuntu 23.10firefox1:1snap1-0ubuntu1
ubuntu 24.04expat2.4.5-2
ubuntu 24.04firefox1:1snap1-0ubuntu1
ubuntu 24.04libxmltok1.2-4.1ubuntu1
ubuntu 24.04swish-eno fix listed
ubuntu 24.04xmlrpc-cno fix listed
ubuntu 24.10expat2.4.5-2
ubuntu 24.10firefox1:1snap1-0ubuntu1
ubuntu 24.10libxmltok1.2-4.1ubuntu1
ubuntu 25.04expat2.4.5-2
ubuntu 25.04firefox1:1snap1-0ubuntu1
ubuntu 25.04libxmltok1.2-4.1ubuntu1
ubuntu 25.10expat2.4.5-2
ubuntu 25.10firefox1:1snap1-0ubuntu1
ubuntu 26.04expat2.4.5-2
ubuntu 26.04firefox1:1snap1-0ubuntu1
ubuntu 26.04swish-eno fix listed
ubuntu 26.10expat2.4.5-2
ubuntu 26.10firefox1:1snap1-0ubuntu1
ubuntu 26.10swish-eno fix listed

References

All 42 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.