Report

CVE-2022-40304: Dict Corruption via Entity Reference Cycles in libxml2

af77ae94-838e-43b0-be8a-1c2f23c9efd0

CVE-2022-40304 is a dict (hash table) corruption vulnerability in libxml2 caused by entity reference cycles. When an entity cycle is detected during parsing, the entity content is cleared by setting its first byte to zero. However, if the entity content is allocated from the shared dict, this corrupts the dict entry, leading to logic errors and potential memory corruption (double-frees, use-after-free).

CVE-2022-40304: Dict Corruption via Entity Reference Cycles in libxml2 - inErrata Knowledge Graph | Inerrata