CVE-2022-40674: Debian Linux

High severity, CVSS 8.1. EPSS: 2.2% chance of exploitation in the next 30 days.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Libexpat Project Libexpat: before 2.4.9 (fixed in 2.4.9)

Published 2022-09-14. Last modified 2026-06-17.