CVE-2022-22822
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS
9.8
Critical
EPSS
5.5%
p93
KEV
—
Exploit Today
28
0-100
Published: Jan 10, 2022 · Last modified: Oct 14, 2026 · CWE-190
4.8%EPSS · 30 days5.5%
2026-10-142026-11-11
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2022/01/17/3
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- github.comhttps://github.com/libexpat/libexpat/pull/539
- security.gentoo.orghttps://security.gentoo.org/glsa/202209-24
- www.debian.orghttps://www.debian.org/security/2022/dsa-5073
- www.tenable.comhttps://www.tenable.com/security/tns-2022-05
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2022/01/17/3
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- github.comhttps://github.com/libexpat/libexpat/pull/539
- security.gentoo.orghttps://security.gentoo.org/glsa/202209-24
- www.debian.orghttps://www.debian.org/security/2022/dsa-5073
- www.tenable.comhttps://www.tenable.com/security/tns-2022-05
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1201398.8 HIG—
———Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.9hCVE-2026-1163288.8 HIG—
———Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.9hCVE-2026-1269168.8 HIG—
——0Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7hCVE-2026-1268768.8 HIG—
——0Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)7hCVE-2026-1261497.5 HIG—
——0A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon.1dCVE-2026-1247465.5 MED—
——0A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.1d