CVE-2022-25315: Libexpat Buffer Overflow Vulnerability

CVE-2022-25315 Overview

CVE-2022-25315 is an integer overflow vulnerability [CWE-190] in the storeRawNames function of Expat (also known as libexpat), an XML parsing library written in C. The flaw affects all versions of libexpat prior to 2.4.5. Because libexpat is embedded in numerous operating systems, web servers, and industrial products, the impact extends well beyond the upstream library. The vulnerability is remotely exploitable over the network without authentication or user interaction, and it can compromise confidentiality, integrity, and availability of affected systems.

Critical Impact

An unauthenticated remote attacker can supply crafted XML input that triggers an integer overflow in storeRawNames, potentially leading to memory corruption and arbitrary code execution in any application linking libexpat.

Affected Products

• libexpat versions prior to 2.4.5
• Debian Linux 10 and 11, Fedora 34 and 35, and Gentoo Linux distributions
• Oracle HTTP Server 12.2.1.3.0 and 12.2.1.4.0, Oracle ZFS Storage Appliance Kit 8.8, and Siemens SINEMA Remote Connect Server

Discovery Timeline

• 2022-02-18 - CVE-2022-25315 published to the National Vulnerability Database (NVD)
• 2022-02-19 - Public discussion on the Openwall oss-security mailing list
• 2022-03 - Debian LTS and DSA-5085 advisories released
• 2022-04 - Oracle Critical Patch Update addresses affected products
• 2025-05-05 - Last updated in the NVD database

Technical Details for CVE-2022-25315

Vulnerability Analysis

The vulnerability resides in the storeRawNames function in libexpat, which copies raw element names from the parser input buffer into per-tag storage during XML processing. Length calculations on these names are performed using a type that can overflow when an attacker supplies sufficiently large input. On 32-bit platforms the overflow is reached with substantially smaller payloads, but 64-bit systems remain vulnerable when memory pressure permits very large XML documents.

Once the overflow occurs, libexpat allocates an undersized buffer and then writes attacker-controlled tag data past its bounds. The resulting heap memory corruption can be steered into arbitrary code execution, depending on the host application's allocator state and mitigations. Because libexpat is consumed by web servers, language runtimes, and embedded firmware, exploitation surfaces include any service that parses untrusted XML.

Root Cause

The root cause is an unchecked arithmetic operation when computing the storage size required for tag names in storeRawNames. The size expression can wrap around the integer range, producing a small allocation that does not match the actual data length that will subsequently be copied. The upstream fix in libexpat pull request 559 introduces explicit overflow checks before allocation.

Attack Vector

An attacker delivers a crafted XML document to any application that parses input with libexpat. Typical delivery paths include HTTP request bodies handled by Oracle HTTP Server, SOAP and XML-RPC endpoints, configuration imports in Siemens SINEMA Remote Connect Server, and document processing pipelines on Debian and Fedora systems. No credentials or user interaction are required. See the GitHub libexpat Pull Request and the Openwall OSS Security Discussion for technical details on the overflow path.

No verified public proof-of-concept code is available for this CVE. The vulnerability mechanism is documented in upstream commits and the linked references rather than reproduced here.

Detection Methods for CVE-2022-25315

Indicators of Compromise

• Crashes or segmentation faults in processes that link libexpat, such as httpd, python, or XML-aware daemons, when handling external input
• Unusually large XML documents or tag names received by public-facing parsers, particularly payloads exceeding hundreds of megabytes
• Unexpected child process creation or outbound network connections from XML-parsing services following inbound XML traffic

Detection Strategies

• Inventory installed libexpat versions across hosts and containers using package managers and software bill of materials (SBOM) data, flagging anything earlier than 2.4.5
• Inspect application logs from Oracle HTTP Server, Siemens SINEMA Remote Connect Server, and other affected products for parser errors or abrupt restarts correlated with XML traffic
• Use endpoint detection telemetry to correlate XML-parsing process crashes with subsequent suspicious child processes

Monitoring Recommendations

• Alert on repeated abnormal terminations of services known to embed libexpat, and capture core dumps for analysis
• Monitor network traffic for oversized XML payloads directed at SOAP, REST, and management interfaces
• Track vendor advisories from Debian, Fedora, Gentoo, Oracle, NetApp, and Siemens for follow-on patches to dependent products

How to Mitigate CVE-2022-25315

Immediate Actions Required

• Upgrade libexpat to version 2.4.5 or later on every host, container image, and embedded device that ships the library
• Apply distribution updates referenced in Debian Security DSA-5085, the Debian LTS Announcement, the Fedora package announcements, and Gentoo GLSA 2022-09-24
• Install vendor patches for Oracle products per the Oracle CPU April 2022 Security Alerts and for Siemens products per the Siemens Product Security Advisory
• Rebuild or update third-party applications that statically link libexpat, since updating the system package alone will not remediate them

Patch Information

The upstream fix is included in libexpat 2.4.5 and merged through GitHub libexpat Pull Request 559. Downstream patches are available from Debian, Fedora, Gentoo, NetApp (ntap-20220303-0008), Oracle, and Siemens.

Workarounds

• Restrict the maximum size of XML payloads accepted by network-facing services using a web application firewall or reverse proxy
• Disable or network-isolate XML-parsing endpoints that are not required for business operations until patches are deployed
• Run XML-processing services under least-privilege accounts and with operating system hardening such as ASLR and stack canaries to raise exploitation cost

# Verify the installed libexpat version on Debian-based systems
dpkg -l | grep -i libexpat

# Verify the installed libexpat version on RPM-based systems
rpm -q expat

# Apply distribution updates
sudo apt-get update && sudo apt-get install --only-upgrade libexpat1
sudo dnf update expat