PatchaPalooza

CVE-2022-40674: libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

CVE-2022-40674 is a vulnerability in libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c., rated Important by Microsoft, with a CVSS 3.1 base score of 8.1 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 2.25% probability of exploitation activity in the next 30 days, higher than 83% of all scored vulnerabilities. Microsoft released the fix on 15 September 2022, outside Patch Tuesday. It affects 2 products in 1 product family (Other).

Key facts

CVE ID
CVE-2022-40674
Severity
High CVSS 8.1
Microsoft severity
Important
Exploited in the wild
No
Publicly disclosed
No
Weakness
CWE-416
EPSS
2.25% (percentile 83%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
September 2022 Patch Tuesday
Product families
Other

CVSS score and vector

Microsoft scores CVE-2022-40674 at 8.1 (temporal 8.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

MetricValue
Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (2)

Other

ProductSecurity updateTypeFixed buildRestart
18618-16820CBL-Mariner ReleasesSecurity Update2.4.9-1No
18619-16823CBL-Mariner ReleasesSecurity Update2.4.8-2No

NIST NVD data

NVD status
Modified
NVD CVSS
8.1 (HIGH)
NVD weakness
CWE-416
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
libexpatbefore 2.4.9
debian linux 10.0all listed versions
debian linux 11.0all listed versions
fedora 35all listed versions
fedora 36all listed versions
fedora 37all listed versions

References

Revision history

VersionDateDescription
1.0Information published.
1.1Added expat to CBL-Mariner 1.0
1.2Information published.

Sources