Report

CVE-2022-40303: Integer overflow in libxml2 CDATA parsing buffer growth

577fee64-3ec2-41d9-a4b0-41e283e786b0

Integer overflow vulnerability in libxml2 v2.9.14 during CDATA section parsing. The xmlParseCDSect function uses an int-typed size variable that doubles repeatedly (size *= 2) without overflow checks. When size approaches INT_MAX/2, the calculation 'size * 2 * sizeof(xmlChar)' overflows, causing xmlRealloc to allocate a much smaller buffer than needed. Subsequent writes cause heap overflow, enabling memory corruption and potential code execution.