--- id: CVE-2022-43680 title: >- In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. summary: >- In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-416 - CWE-416 vendor: libexpat_project product: libexpat affected: - libexpat <= 2.4.9 - debian_linux = 10.0 - debian_linux = 11.0 - fedora = 35 - fedora = 36 - fedora = 37 - h300s_firmware - h500s_firmware - h700s_firmware - h410s_firmware - h410c_firmware - active_iq_unified_manager - oncommand_workflow_automation - solidfire_&_hci_management_node - hci_compute_node_firmware published: '2022-10-24' updated: '2026-10-14' sourceUpdated: '2026-10-14T19:16:53.627' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-43680' references: - url: 'http://www.openwall.com/lists/oss-security/2023/12/28/5' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2024/01/03/5' label: cve@mitre.org - url: 'https://github.com/libexpat/libexpat/issues/649' label: cve@mitre.org - url: 'https://github.com/libexpat/libexpat/pull/616' label: cve@mitre.org - url: 'https://github.com/libexpat/libexpat/pull/650' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202210-38' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20221118-0007/' label: cve@mitre.org - url: 'https://www.debian.org/security/2022/dsa-5266' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/12/28/5' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2024/01/03/5' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/libexpat/libexpat/issues/649' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/libexpat/libexpat/pull/616' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/libexpat/libexpat/pull/650' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202210-38' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20221118-0007/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2022/dsa-5266' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-892048.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd - exploit-available epss: 0.02457 epssPercentile: 0.84105 exploits: github: 2 githubRepos: - 'https://github.com/Trinadh465/external_expat-2.1.0_CVE-2022-43680' - 'https://github.com/nidhihcl/external_expat_2.1.0_CVE-2022-43680' checkedAt: '2026-10-14T19:50:33.260Z' exploitAvailable: true ingestedAt: '2026-10-14T19:49:57.522Z' --- ## Overview In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. ## Affected - `libexpat <= 2.4.9` - `debian_linux = 10.0` - `debian_linux = 11.0` - `fedora = 35` - `fedora = 36` - `fedora = 37` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h410s_firmware` - `h410c_firmware` - `active_iq_unified_manager` - `oncommand_workflow_automation` - `solidfire_&_hci_management_node` - `hci_compute_node_firmware` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.