CVE-2016-5131

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-23 · updated 2026-10-14
Weakness: CWE-416

Description

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

Affected products

Apple Iphone Os: before 10.0 — fixed in 10.0
macOS: before 10.12 — fixed in 10.12
Apple tvOS: before 10.0 — fixed in 10.0
Apple watchOS: before 3.0 — fixed in 3.0
Canonical Ubuntu Linux: 14.04, 16.04
Debian Linux: 8.0, 9.0
Google Chrome: before 52.0.2743.82 — fixed in 52.0.2743.82
openSUSE Leap: 42.1
Opensuse: 13.1, 13.2
RedHat Enterprise Linux Desktop: 6.0
RedHat Enterprise Linux Server: 6.0
RedHat Enterprise Linux Workstation: 6.0
SUSE Linux Enterprise: 12.0
xmlsoft libxml2: through 2.9.4

How to fix

Upgrade to a fixed version: Apple Iphone Os 10.0; macOS 10.12; Apple tvOS 10.0; Apple watchOS 3.0; Google Chrome 52.0.2743.82. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-5131 or the next vulnerability affects your stack