CVE-2022-25235: debian debian_linux Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2022-25235 is a critical (CVSS 9.8) Improper Encoding or Escaping of Output vulnerability in debian debian_linux. EPSS estimates a 4.96% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities.
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 36 · Related 13Timeline
- 16-02-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.96%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu13 products
- ayttm< 0.6.3-3ubuntu0.1~esm1
- cableswig< 0.1.0+git20150808-2ubuntu0.1~esm1
- coin3< 3.1.4~abc9f50-4ubuntu2+esm2 | < 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2 | < 3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
- expat< 2.1.0-4ubuntu1.4+esm4 | < 2.1.0-7ubuntu0.16.04.5+esm2 | < 2.2.5-3ubuntu0.4 | < 2.2.9-1ubuntu0.2
- firefox< 1:1snap1-0ubuntu1
Redhat9 products
- xmlrpc-c< 0:1.51.0-5.el8_1.1 | < 0:1.51.0-5.el8_2.1 | < 0:1.51.0-5.el8_5.1 | < 0:1.51.0-5.el8_4.1
- xmlrpc-c-apps-debuginfo< 0:1.51.0-5.el8_1.1 | < 0:1.51.0-5.el8_2.1 | < 0:1.51.0-5.el8_5.1 | < 0:1.51.0-5.el8_4.1
- xmlrpc-c-c++< 0:1.51.0-5.el8_2.1 | < 0:1.51.0-5.el8_5.1 | < 0:1.51.0-5.el8_4.1
- xmlrpc-c-c++-debuginfo< 0:1.51.0-5.el8_1.1 | < 0:1.51.0-5.el8_2.1 | < 0:1.51.0-5.el8_5.1 | < 0:1.51.0-5.el8_4.1
- xmlrpc-c-client< 0:1.51.0-5.el8_1.1 | < 0:1.51.0-5.el8_2.1 | < 0:1.51.0-5.el8_5.1 | < 0:1.51.0-5.el8_4.1
Debian3 products
- expat< 2.4.5-1
- libxmltokAll versions (No fix recorded)
- debian_linuxEOL10.0 | 11.0
Oracle2 products
- http_server12.2.1.3.0 | 12.2.1.4.0
- zfs_storage_appliance_kit8.8
Alpine1 product
- expat< 2.2.10-r2 | < 2.2.10-r4 | < 2.4.5-r0
Fedoraproject1 product
- fedoraEOL34 | 35
Libexpat_project1 product
- libexpat< 2.4.5
Mageia1 product
- xmlrpc-c< 1.51.06-1.1.mga8
Siemens1 product
9 vendors · 32 products
References
40 links
- lists.debian.org/debian-lts-announce/2022/03/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory
