CVE-2022-25236
Published: 16 February 2022
Summary
CVE-2022-25236 is a critical-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Debian Debian Linux. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-25236 is a vulnerability in xmlparse.c within Expat (also known as libexpat) versions prior to 2.4.5. It permits attackers to insert namespace-separator characters into namespace URIs. The flaw carries a CVSS 3.1 base score of 9.8 and is associated with CWE-668.
The issue can be exploited remotely by unauthenticated attackers over the network without user interaction, enabling full compromise of confidentiality, integrity, and availability on affected systems. Public references link the flaw to XMPP stanza smuggling attacks, including a reported remote code execution path against Zoom clients that leverage the XML parsing behavior.
Advisories and patches recommend upgrading to libexpat 2.4.5 or later. The official fix is tracked in GitHub pull request 561, with distribution updates issued by Debian LTS and product-specific guidance such as Siemens SSA-484086.
The associated EPSS score reached a peak of 0.0936 with a current value of 0.0796; one reference describes a concrete remote-code-execution technique against Zoom via XMPP, indicating targeted real-world interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29934
Vulnerability details
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.
The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.
The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.
Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.
Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.
Controlling internal connections prevents exposure of resources to unintended internal spheres.
Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.
The control prevents exposure of the media resource to the wrong security sphere.