CVE-2022-40303

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.10.3

Description The issue is related to an integer overflow in the xmlParseNameComplex() function of the libxml2 library when parsing XML documents with the XML PARSE HUGE parser option enabled. This can lead to an attempt to access an array at a negative offset, typically resulting in a segmentation fault. A remote attacker could exploit this issue to execute arbitrary code on the system by persuading a victim to open a specially-crafted file.

Recommendations For libxml2 versions prior to 2.10.3, update to version 2.10.3 or later to resolve the issue. As a temporary workaround, consider disabling the XML PARSE HUGE parser option when parsing XML documents to minimize the risk of exploitation. Restrict access to the xmlParseNameComplex() function until a patch is available. Avoid using the XML PARSE HUGE option in the affected API endpoint until the issue is resolved.