CVE-2016-4658
criticalxpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbi…
Vendor / product: Apple — iphone os
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
CVSS
9.8
9.8 (CVSS v3.0)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.0 (nvd@nist.gov)
Timeline (UTC)
Published: 2016-09-25 10:59
Modified: 2026-10-14 07:16
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
apple / iphone_os <10.0
apple / mac_os_x <10.12
apple / tvos <10.0
apple / watchos <3.0
xmlsoft / libxml2 <2.9.5
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://support.apple.com/HT207141
Vendor advisory: https://support.apple.com/HT207142
Vendor advisory: https://support.apple.com/HT207143
Vendor advisory: https://support.apple.com/HT207170
References
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html product-security@apple.com
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html product-security@apple.com
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html product-security@apple.com
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html product-security@apple.com
- http://www.securityfocus.com/bid/93054 product-security@apple.com
- http://www.securitytracker.com/id/1036858 product-security@apple.com
- http://www.securitytracker.com/id/1038623 product-security@apple.com
- https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b product-security@apple.com
- https://security.gentoo.org/glsa/201701-37 product-security@apple.com
- https://support.apple.com/HT207141 product-security@apple.com
- https://support.apple.com/HT207142 product-security@apple.com
- https://support.apple.com/HT207143 product-security@apple.com
- https://support.apple.com/HT207170 product-security@apple.com
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/93054 af854a3a-2127-422b-91ae-364da2661108
- http://www.securitytracker.com/id/1036858 af854a3a-2127-422b-91ae-364da2661108
- http://www.securitytracker.com/id/1038623 af854a3a-2127-422b-91ae-364da2661108
- https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/201701-37 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/HT207141 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/HT207142 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/HT207143 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗