CVE-2022-43680

Name of the Vulnerable Software and Affected Versions libexpat versions 2.4.9 and earlier

Description The issue is related to a use-after-free vulnerability in the XML ExternalEntityParserCreate function of the libexpat XML parsing library. This vulnerability can be exploited by a remote attacker to cause a denial of service. The vulnerability occurs due to the overeager destruction of a shared DTD in out-of-memory situations. It may also lead to remote code execution with no additional execution privileges needed, and user interaction is not required for exploitation.

Recommendations For libexpat versions 2.4.9 and earlier, update to a version later than 2.4.9 to resolve the issue. As a temporary workaround, consider disabling the XML ExternalEntityParserCreate function until a patch is available. Restrict access to the vulnerable library to minimize the risk of exploitation.