CVE-2022-40303Libxml2 Integer Overflow
When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow.
Published Nov 23, 2022 · Updated Oct 22, 2026 · Also known as A-260709824, ALPINE-CVE-2022-40303, DEBIAN-CVE-2022-40303, DLA-3172-1, DSA-5271-1, JLSEC-2025-77, PUB-A-260709824, SUSE-SU-2022:3692-1, UBUNTU-CVE-2022-40303, USN-5760-2, USN-7659-1
Key Facts
Patch immediately- CVE-2022-40303 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Active Iq Unified Manager (Netapp), Clustered Data Ontap (Netapp), Clustered Data Ontap Antivirus Connector (Netapp) and 22 more products.
- It is exploited in the wild, listed in Industry KEV feed since Dec 13, 2022. No public exploit code is known.
- EPSS estimates a 41% probability of exploitation in the next 30 days.
- Fixed versions are available, including Ipados 15.7.2, Iphone OS 15.7.2, Macos 11.7.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
41%
Higher than 98.6% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Dec 13, 2022
20 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2022-40303
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2022-40303
- advisoryhttps://security.alpinelinux.org/vuln/CVE-2022-40303
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2022-40303
- advisoryhttps://ubuntu.com/security/CVE-2022-40303
- advisoryRHSA-2022:8841
Description
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Dec 13, 2022 | n/a | Not reported |
Affected Products
385 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Clustered Data OntapNetapp | See advisory | n/a |
| Clustered Data Ontap Antivirus ConnectorNetapp | See advisory | n/a |
| Netapp Manageability SdkNetapp | See advisory | n/a |
| Ontap Select Deploy Administration UtilityNetapp | See advisory | n/a |
Patched Releases
Ipados
15.7.2
Iphone OS
15.7.2
Macos
11.7.2, 12.6.2
Tvos
16.2
Watchos
9.2
Libxml2
0:2.9.13-3.el9_1, 0:2.9.7-13.el8_6.4, 2.10.3, 2.10.3-1, 2.10.3-2.amzn2022, 2.10.3-2.amzn2023.0.1, 2.10.3-r0, 2.11.4-1.ph5, 2.9.1-6.6.42.amzn1, 2.9.1-6.amzn2.5.7, 2.9.1+dfsg1-3ubuntu4.13+esm4, 2.9.10+dfsg-5ubuntu0.20.04.5, 2.9.10+dfsg-6.7+deb11u3, 2.9.11-6.ph2, 2.9.11-9.ph3, 2.9.12-7.ph4, 2.9.13-3.el9_1, 2.9.13-6.el9_4+sp999, 2.9.13+dfsg-1ubuntu0.2, 2.9.14-150400.5.10.1, 2.9.14-3, 2.9.14-r2, 2.9.14+dfsg-1.1, 2.9.3+dfsg1-1ubuntu0.7+esm4, 2.9.4-46.59.2, 2.9.4+dfsg1-6.1ubuntu1.8, 2.9.4+dfsg1-7+deb10u5, 2.9.7-15.el8_7.1, 2.9.7-150000.3.51.1, 2.9.7-18.el8_10.1+sp999
libxml2-2
2.10.3-1.1, 2.9.14-150400.5.10.1, 2.9.4-46.59.2, 2.9.7-150000.3.51.1
libxml2-2-32bit
2.10.3-1.1, 2.9.14-150400.5.10.1, 2.9.4-46.59.2, 2.9.7-150000.3.51.1
libxml2-devel
2.10.3-1.1, 2.10.3-2.amzn2022, 2.10.3-2.amzn2023.0.1, 2.11.4-1.ph5, 2.9.1-6.6.42.amzn1, 2.9.1-6.amzn2.5.7, 2.9.12-7.ph4, 2.9.13-3.el9_1, 2.9.14-150400.5.10.1, 2.9.4-46.59.2, 2.9.7-15.el8_7.1, 2.9.7-150000.3.51.1
libxml2-devel-32bit
2.10.3-1.1, 2.9.14-150400.5.10.1, 2.9.7-150000.3.51.1
libxml2-doc
2.10.3-1.1, 2.9.14-150400.5.10.1, 2.9.4-46.59.2, 2.9.7-150000.3.51.1
libxml2-python
2.9.1-6.amzn2.5.7, 2.9.14-150400.5.10.1
libxml2-python26
2.9.1-6.6.42.amzn1
libxml2-python27
2.9.1-6.6.42.amzn1
libxml2-static
2.10.3-2.amzn2022, 2.10.3-2.amzn2023.0.1, 2.9.1-6.6.42.amzn1, 2.9.1-6.amzn2.5.7
libxml2-tools
2.10.3-1.1, 2.9.14-150400.5.10.1, 2.9.4-46.59.2, 2.9.7-150000.3.51.1
platform/external/libxml2
13:2023-03-01
python-libxml2
2.9.4-46.59.3
python-libxml2-python
2.9.7-150000.3.51.1
python2-libxml2-python
2.9.7-150000.3.51.1
python3-libxml2
2.10.3-2.amzn2022, 2.10.3-2.amzn2023.0.1, 2.11.4-1.ph5, 2.9.12-7.ph4, 2.9.13-3.el9_1, 2.9.14-150400.5.10.1, 2.9.7-15.el8_7.1
python3-libxml2-python
2.9.7-150000.3.51.1
rootio-libxml2
2.9.10+dfsg-6.7+deb11u3, 2.9.14+dfsg-1.1
ruby-nokogiri
1.10.7+dfsg1-2ubuntu0.1~esm2, 1.13.1+dfsg-2ubuntu0.1~esm1
seal-libxml2
2.9.13-6.el9_4+sp999, 2.9.7-18.el8_10.1+sp999
Timeline
Publicly disclosed
Nov 23, 2022
Added to Industry KEV feed
Dec 13, 2022
Last updated
Oct 22, 2026
Weakness Type
- CWE-190 Integer Overflow or Wraparound
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2022-40303
- advisorysecurity.alpinelinux.org · CVE-2022-40303
- advisorysecurity-tracker.debian.org · CVE-2022-40303
- advisoryubuntu.com · CVE-2022-40303
FAQ
Common Questions.
An issue was discovered in libxml2 before 2.10.3.
Affected: Active Iq Unified Manager (Netapp); Clustered Data Ontap (Netapp); Clustered Data Ontap Antivirus Connector (Netapp), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Dec 13, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Ipados 15.7.2, Iphone OS 15.7.2, Macos 11.7.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2022-40303 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo