7.5

CVE-2022-23308: apple ipados Use After Free

Modified
AliasesALPINE-CVE-2022-23308MGASA-2022-0084SUSE-SU-2022:0802-1
Published 26-02-2022Last modified 14-10-2026

Vulnerability summary

CVE-2022-23308 is a high (CVSS 7.5) Use After Free vulnerability in apple ipados. EPSS estimates a 5.12% chance of exploitation in the next 30 days, higher than 92.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
5.12%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8
DLA-2972-1OPENSUSE-SU-2024:11912-1OPENSUSE-SU-2024:13165-1OPENSUSE-SU-2024:14174-1OPENSUSE-SU-2025:14697-1OPENSUSE-SU-2026:10356-1

Timeline

  1. 26-02-2022
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

5.12%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse54 products
  • libxml2-python&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.7.6-0.77.43.1
  • libxml2-python&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.7.6-0.77.43.1
  • libxml2&distro=HPE Helion OpenStack 8< 2.9.4-46.49.1
  • libxml2&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.7.6-0.77.43.1
  • libxml2&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.7.6-0.77.43.1
Netapp19 products
Oracle7 products
Apple6 products
  • ipados< 15.5
  • iphone_os< 15.5
  • mac_os_x≥ 10.15.0, < 10.15.7 | 10.15.7 | 10.15.7:security_update_2020-001 | 10.15.7:security_update_2021-001 | 10.15.7:security_update_2021-002 | 10.15.7:security_update_2021-003 | 10.15.7:security_update_2021-004 | 10.15.7:security_update_2021-005 | 10.15.7:security_update_2021-006 | 10.15.7:security_update_2021-007 | 10.15.7:security_update_2021-008 | 10.15.7:security_update_2022-001 | 10.15.7:security_update_2022-003
  • macos≥ 11.6.0, < 11.6.6 | ≥ 12.0, < 12.4
  • tvos< 15.5
Redhat6 products
  • libxml2< 0:2.9.7-12.el8_5
  • libxml2-debuginfo< 0:2.9.7-12.el8_5
  • libxml2-debugsource< 0:2.9.7-12.el8_5
  • libxml2-devel< 0:2.9.7-12.el8_5
  • python3-libxml2< 0:2.9.7-12.el8_5
Alpine2 products
  • libxml2< 2.9.13-r0
  • qt5-qtwebengine< 5.15.11-r12 | < 5.15.11-r13
Debian2 products
Opensuse2 products
  • libxml2&distro=openSUSE Tumbleweed< 2.9.13-1.1
  • python-libxml2-python&distro=openSUSE Leap 15.3< 2.9.7-3.40.1
Fedoraproject1 product
Mageia1 product
  • libxml2< 2.9.10-7.3.mga8
Ubuntu1 product
  • libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm3 | < 2.9.3+dfsg1-1ubuntu0.7+esm2 | < 2.9.4+dfsg1-6.1ubuntu1.5 | < 2.9.10+dfsg-5ubuntu0.20.04.2
Xmlsoft1 product

12 vendors · 102 products

References

44 links
Show all 44 references