Vulnerability Details CVE-2022-26507
A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This is not the same as any of: CVE-2021-21810, CVE-2021-21811, CVE-2021-21812, CVE-2021-21815, CVE-2021-21825, CVE-2021-21826, CVE-2021-21828, CVE-2021-21829, or CVE-2021-21830. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Exploit prediction scoring system (EPSS) score
EPSS Score 0.03
EPSS Ranking 86.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2022-26507
-
cpe:2.3:a:att:xmill:0.7
-
cpe:2.3:a:schneider-electric:ecostruxure_control_expert:-
-
cpe:2.3:a:schneider-electric:ecostruxure_control_expert:14.0
-
cpe:2.3:a:schneider-electric:ecostruxure_control_expert:14.1
-
cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0
-
cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.1
-
cpe:2.3:a:schneider-electric:ecostruxure_process_expert:-
-
cpe:2.3:a:schneider-electric:ecostruxure_process_expert:2020
-
cpe:2.3:a:schneider-electric:remoteconnect:-
-
cpe:2.3:h:schneider-electric:scadapack_470:-
-
cpe:2.3:h:schneider-electric:scadapack_474:-
-
cpe:2.3:h:schneider-electric:scadapack_570:-
-
cpe:2.3:h:schneider-electric:scadapack_574:-
-
cpe:2.3:h:schneider-electric:scadapack_575:-