CVE-2022-22826: 
Tenable Nessus vulnerability analysis and mitigation

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. This vulnerability was identified with CVE-2022-22826 and was discovered in January 2022 (NVD, MITRE).

The vulnerability is related to integer overflow issues in the nextScaffoldPart function within xmlparse.c of the Expat library. The issue was assigned a CVSS v3.1 Base Score of 8.8 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates a high severity vulnerability with network attack vector, low attack complexity, no privileges required, and user interaction required (NVD).

If exploited, this vulnerability could lead to denial of service or potentially the execution of arbitrary code when processing malformed XML files (Debian Security).

The vulnerability was fixed in Expat version 2.4.3. Users and organizations are strongly recommended to upgrade to this version or later. Multiple Linux distributions have also released patched versions - Debian fixed it in version 2.2.10-2+deb11u1 for bullseye and 2.2.6-2+deb10u2 for buster (Debian Security), while Gentoo addressed it in version 2.4.9 (Gentoo Security).