CVE-2022-41704

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

2.35%

Published

Oct 25, 2022

Modified

Feb 25, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918CWE-918

Affected Products (3)

apache · batik (up to 1.16)vulnerable

debian · debian_linuxvulnerable

References (10)

http://www.openwall.com/lists/oss-security/2022/10/25/2

Mailing ListThird Party Advisory

https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202401-11

https://www.debian.org/security/2022/dsa-5264

Third Party Advisory

http://www.openwall.com/lists/oss-security/2022/10/25/2

Mailing ListThird Party Advisory

https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202401-11

https://www.debian.org/security/2022/dsa-5264

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs