--- id: CVE-2022-23308 title: >- valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. summary: >- valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-416 - CWE-416 vendor: xmlsoft product: libxml2 affected: - libxml2 < 2.9.13 - fedora = 34 - debian_linux = 9.0 - ipados < 15.5 - iphone_os < 15.5 - 'mac_os_x >= 10.15.0, < 10.15.7' - mac_os_x = 10.15.7 - 'macos >= 11.6.0, < 11.6.6' - 'macos >= 12.0, < 12.4' - tvos < 15.5 - watchos < 8.6 - active_iq_unified_manager - clustered_data_ontap - clustered_data_ontap_antivirus_connector - manageability_software_development_kit - ontap_select_deploy_administration_utility - smi-s_provider - snapdrive - snapmanager - 'solidfire,_enterprise_sds_&_hci_storage_node' - solidfire_&_hci_management_node - bootstrap_os - h300s_firmware - h500s_firmware - h700s_firmware - h300e_firmware - h500e_firmware - h700e_firmware - h410s_firmware - h410c_firmware - communications_cloud_native_core_binding_support_function = 22.2.0 - >- communications_cloud_native_core_network_function_cloud_native_environment = 22.1.0 - communications_cloud_native_core_network_repository_function = 22.1.2 - communications_cloud_native_core_network_repository_function = 22.2.0 - communications_cloud_native_core_network_slice_selection_function = 22.1.1 - communications_cloud_native_core_unified_data_repository = 22.2.0 - mysql_workbench <= 8.0.29 - zfs_storage_appliance_kit = 8.8 patched: - libxml2 2.9.13 - ipados 15.5 - iphone_os 15.5 - mac_os_x 10.15.7 - macos 12.4 - tvos 15.5 - watchos 8.6 published: '2022-02-26' updated: '2026-10-14' sourceUpdated: '2026-10-14T16:17:27.060' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23308' references: - url: 'http://seclists.org/fulldisclosure/2022/May/33' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2022/May/34' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2022/May/35' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2022/May/36' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2022/May/37' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2022/May/38' label: cve@mitre.org - url: >- https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e label: cve@mitre.org - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202210-03' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20220331-0008/' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213253' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213254' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213255' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213256' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213257' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213258' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: cve@mitre.org - url: 'http://seclists.org/fulldisclosure/2022/May/33' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2022/May/34' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2022/May/35' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2022/May/36' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2022/May/37' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2022/May/38' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202210-03' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20220331-0008/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213253' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213254' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213255' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213256' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213257' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213258' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-419740.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-942865.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.0512 epssPercentile: 0.92209 ingestedAt: '2026-10-14T16:40:32.046Z' --- ## Overview valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. ## Affected - `libxml2 < 2.9.13` - `fedora = 34` - `debian_linux = 9.0` - `ipados < 15.5` - `iphone_os < 15.5` - `mac_os_x >= 10.15.0, < 10.15.7` - `mac_os_x = 10.15.7` - `macos >= 11.6.0, < 11.6.6` - `macos >= 12.0, < 12.4` - `tvos < 15.5` - `watchos < 8.6` - `active_iq_unified_manager` - `clustered_data_ontap` - `clustered_data_ontap_antivirus_connector` - `manageability_software_development_kit` - `ontap_select_deploy_administration_utility` - `smi-s_provider` - `snapdrive` - `snapmanager` - `solidfire,_enterprise_sds_&_hci_storage_node` - `solidfire_&_hci_management_node` - `bootstrap_os` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h300e_firmware` - `h500e_firmware` - `h700e_firmware` - `h410s_firmware` - `h410c_firmware` - `communications_cloud_native_core_binding_support_function = 22.2.0` - `communications_cloud_native_core_network_function_cloud_native_environment = 22.1.0` - `communications_cloud_native_core_network_repository_function = 22.1.2` - `communications_cloud_native_core_network_repository_function = 22.2.0` - `communications_cloud_native_core_network_slice_selection_function = 22.1.1` - `communications_cloud_native_core_unified_data_repository = 22.2.0` - `mysql_workbench <= 8.0.29` - `zfs_storage_appliance_kit = 8.8` ## Remediation Upgrade past the affected range: - `libxml2 2.9.13` - `ipados 15.5` - `iphone_os 15.5` - `mac_os_x 10.15.7` - `macos 12.4` - `tvos 15.5` - `watchos 8.6`