CVE-2022-22824

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.4.3

Description The issue is related to an integer overflow in the defineAttribute function of the xmlparse.c file in the Expat library. This could allow a remote attacker to cause a denial of service. There is also a mention of a potential for arbitrary code execution on the system by exploiting this integer overflow, possibly by persuading a victim to open a specially crafted file.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the defineAttribute function in xmlparse.c until a patch is available.