CVE-2022-23308
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 5.1% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-25)
- CWE
- CWE-416
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:ipados
- apple:iphone_os
- apple:mac_os_x
- apple:macos
- apple:tvos
- apple:watchos
- debian:debian_linux
- fedoraproject:fedora
- netapp:active_iq_unified_manager
- netapp:bootstrap_os
- netapp:clustered_data_ontap
- netapp:clustered_data_ontap_antivirus_connector
- netapp:h300e_firmware
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500e_firmware
- netapp:h500s_firmware
- netapp:h700e_firmware
- netapp:h700s_firmware
- netapp:manageability_software_development_kit
- netapp:ontap_select_deploy_administration_utility
- netapp:smi-s_provider
- netapp:snapdrive
- netapp:snapmanager
- netapp:solidfire\,_enterprise_sds_\&_hci_storage_node
- netapp:solidfire_\&_hci_management_node
- oracle:communications_cloud_native_core_binding_support_function
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:communications_cloud_native_core_network_repository_function
- oracle:communications_cloud_native_core_network_slice_selection_function
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:mysql_workbench
- oracle:zfs_storage_appliance_kit
- xmlsoft:libxml2