CVE-2022-40304: apple ipados Double Free
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2022-40304UBUNTU-CVE-2022-40304DEBIAN-CVE-2022-40304CGA-3x5f-hjjj-43q8CGA-qp8r-9hrf-42q5
Published 23-11-2022Last modified 14-10-2026
Vulnerability summary
CVE-2022-40304 is a high (CVSS 7.8) Double Free vulnerability in apple ipados. EPSS estimates a 5.81% chance of exploitation in the next 30 days, higher than 93% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
5.81%
0%100%
Low · -1.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 12 · Related 8Timeline
- 23-11-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.81%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
-1.03 pp
From 6.84% on 18-09-2026
18-09-202618-10-2026
EPSS score5.81%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp11 products
- active_iq_unified_managerna
- clustered_data_ontapna
- clustered_data_ontap_antivirus_connectorna
- h300s_firmwarena
- h410c_firmwarena
Apple5 products
Alpine1 product
- libxml2< 2.9.14-r2 | < 2.10.3-r0
Chainguard1 product
- libxml2All versions (No fix recorded)
Debian1 product
- libxml2< 2.9.14+dfsg-1.1
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm4 | < 2.9.3+dfsg1-1ubuntu0.7+esm4 | < 2.9.4+dfsg1-6.1ubuntu1.8 | < 2.9.10+dfsg-5ubuntu0.20.04.5 | < 2.9.13+dfsg-1ubuntu0.2
Wolfi1 product
- libxml2All versions (No fix recorded)
Xmlsoft1 product
- libxml2< 2.10.3
8 vendors · 22 products
References
28 links- gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80bFIXPatchThird Party Advisory
