CVE-2016-1762

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-03-24 · updated 2026-06-17
Weakness: CWE-119

Description

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Affected products

Apple Iphone Os: before 9.3 — fixed in 9.3
macOS: before 10.11.4 — fixed in 10.11.4
Apple Safari: before 9.1 — fixed in 9.1
Apple tvOS: before 9.2 — fixed in 9.2
Apple watchOS: before 2.2 — fixed in 2.2
Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
Debian Linux: 8.0
McAfee Web Gateway (MWG): through 7.5.2.10; from 7.5.2.11 (excl.) through 7.6.2.3
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 7.2, 7.3, 7.4, 7.6
RedHat Enterprise Linux Server Eus: 7.2, 7.3, 7.4, 7.5, 7.6
RedHat Enterprise Linux Server Tus: 7.2, 7.3, 7.6
RedHat Enterprise Linux Workstation: 6.0, 7.0
xmlsoft libxml2: before 2.9.4 — fixed in 2.9.4

How to fix

Upgrade to a fixed version: Apple Iphone Os 9.3; macOS 10.11.4; Apple Safari 9.1; Apple tvOS 9.2; Apple watchOS 2.2; xmlsoft libxml2 2.9.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-1762 or the next vulnerability affects your stack