CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

5.8% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-25)

CWE

CWE-415

Published

2022-11-23

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• apple:ipados
• apple:iphone_os
• apple:macos
• apple:tvos
• apple:watchos
• netapp:active_iq_unified_manager
• netapp:clustered_data_ontap
• netapp:clustered_data_ontap_antivirus_connector
• netapp:h300s_firmware
• netapp:h410c_firmware
• netapp:h410s_firmware
• netapp:h500s_firmware
• netapp:h700s_firmware
• netapp:manageability_software_development_kit
• netapp:smi-s_provider
• netapp:snapmanager
• xmlsoft:libxml2

References

• http://seclists.org/fulldisclosure/2022/Dec/21
• http://seclists.org/fulldisclosure/2022/Dec/24
• http://seclists.org/fulldisclosure/2022/Dec/25
• http://seclists.org/fulldisclosure/2022/Dec/26
• http://seclists.org/fulldisclosure/2022/Dec/27

Check your stackJSON