CVE-2022-25313

Name of the Vulnerable Software and Affected Versions Expat (aka libexpat) versions prior to 2.4.5

Description The issue is related to a stack exhaustion vulnerability in the build model function of the Expat library, caused by a large nesting depth in the DTD element. This can allow a remote attacker to execute arbitrary code on the system. The vulnerability is also associated with an integer overflow in addBinding in xmlparse.c, which can be exploited by persuading a victim to open a specially-crafted file.

Recommendations For Expat (aka libexpat) versions prior to 2.4.5, update to version 2.4.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the build model function to minimize the risk of exploitation. Additionally, avoid using specially-crafted files that could trigger the integer overflow in addBinding until the issue is resolved.