CVE-2016-1839

No known exploitation. EPSS puts it in the 94th percentile. A vendor fix is available.

CVSS 3.05.5Medium EPSS percentile94th7.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-05-20Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your business systems process XML from untrusted sources (web forms, customer uploads, APIs, emails, partner feeds), and identify which devices/services use the vulnerable libxml2 versions.
If you run Apple devices/OS versions listed in the fix availability, upgrade to at least: iOS 9.3.2, OS X 10.11.5, tvOS 9.2.1, or watchOS 2.2.1.
If you run Linux (including Ubuntu/Debian/Red Hat Enterprise Linux) or a “web gateway” that uses libxml2, upgrade libxml2 to 2.9.4 or newer.
If you can’t upgrade immediately, reduce exposure by blocking untrusted XML sources at the entry point (only accept XML from trusted systems, and reject malformed/unexpected XML content).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

In plain language

Written by AI from the record

This is a libxml2 XML-handling bug in older iPhones, Macs, Apple TVs, and Watches that can crash apps when they process a specially crafted XML document; most small businesses only need to worry if you handle XML from untrusted sources (like customer uploads, web gateways, or partner integrations).

CVE-2016-1839 is a libxml2 heap-based buffer over-read bug in xmlDictAddString (CWE-125) that can be triggered by remote attackers via a crafted XML document, leading to a denial of service; Apple fixed this in iOS 9.3.2, OS X 10.11.5, tvOS 9.2.1, and watchOS 2.2.1, and libxml2 was fixed in 2.9.4.

If you're affected

App/service crashes from XML input
Interruption to customer-facing workflows
Potential denial of service on gateways
Time lost restoring availability

What is it

libxml2 is a common library used to work with XML (a structured text format). In certain older versions, a specially made XML file can make the program read past the expected end of memory and crash—like feeding a broken instruction manual that makes the machine stop working. The main risk is a denial of service (availability), not theft of data.

Who is affected

This matters if you (or your apps) use libxml2 to parse XML on iOS, macOS (OS X), tvOS, watchOS, or on Linux/web gateway components based on libxml2. Your real exposure depends on whether you handle XML coming from others you don’t fully control. If attackers can reach the XML-parsing functionality (for example via a web-facing integration or accepting uploaded/remote XML), then this becomes a practical risk; otherwise, it’s less likely to matter.

How urgent is it

This is an AMBER issue because the bug can be remotely triggered to cause denial of service, meaning availability can be affected. However, there is no KEV entry and no public exploit code recorded, so it’s not confirmed as widespread exploitation. Prioritize patching if you process XML from untrusted sources, since that’s where attackers can realistically trigger the crash.

What to do — in detail

Confirm exposure

Identify where XML parsing happens in your business environment:
- On Apple devices/OS: any apps that parse XML downloaded from the internet, received over network APIs, or imported from external sources.
- On servers/gateways: any service/library stack using libxml2 to parse XML (web gateway, API service, middleware).
Determine the exact versions:
- For Apple: verify iOS/macOS/tvOS/watchOS versions against the fixed versions below.
- For Linux/web gateway: verify the installed libxml2 version.

Target fixed versions

iOS: fixed in 9.3.2 or newer.
macOS (OS X): fixed in 10.11.5 or newer.
tvOS: fixed in 9.2.1 or newer.
watchOS: fixed in 2.2.1 or newer.
libxml2: fixed in 2.9.4 or newer.

Upgrade path / notes

Apple OS upgrades: use the vendor OS update process for each device class.
Linux/web gateway upgrades: update the libxml2 package to 2.9.4 or newer using your distribution’s security updates.
If your environment contains multiple application servers/containers, upgrade them all—one outdated node can remain a crash point.

Temporary workaround (if patching is delayed)

Restrict who/what can send XML into the vulnerable parsing path:
- Only accept XML from trusted systems.
- Add validation to reject unexpected content types and malformed XML early (before it reaches libxml2-based parsing).
- Where possible, use safer formats or enforce strict schema checks.

What to monitor

Monitor for service/app crashes, repeated parsing errors, or spikes in failed/abnormal requests involving XML payloads.
Check logs around XML intake points after updates (or after any crash) to ensure the vulnerable code path is no longer reached.

Technical context

CVE-2016-1839 is a libxml2 vulnerability in xmlDictAddString (CWE-125) that can cause denial of service via a heap-based buffer over-read when parsing crafted XML. In the provided findings, it affects older Apple OS versions (iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, watchOS before 2.2.1) and libxml2 versions before 2.9.4. There is no KEV listing and no public exploit code on record in the findings, so confirmed “in-the-wild” exploitation is not established here. The patch information indicates specific Apple fixes plus the upstream libxml2 fix in 2.9.4. The verdict for this case is AMBER, aligning with an availability impact that’s most relevant when untrusted XML can reach the parsing code path.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS94th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

7.3% chance of exploitation activity in the next 30 days, which ranks it in the 94th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

24 events over 3778 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → 0epss band change
2026-09-05EPSS band change0 → moderateepss band change
2026-08-31EPSS band changemoderate → 0epss band change
2026-08-29EPSS band changelow → moderate

Affected products

Apple Inc.commercial · USaka apple, apple computer
- iOSOSEmbeddedOperating Systems / mobile-os
- mac os xOSOn-premOperating Systems / unix-bsd
- tvosOSEmbeddedOperating Systems / mobile-os
- watchosOSEmbeddedOperating Systems / mobile-os
- OS XOperating Systems
Canonical Ltd.commercial · GBaka canonical
- UbuntuOSOn-premOperating Systems / linux-distro
debianoss-project · GBaka debian gnu/linux
- debian linuxOSOn-premOperating Systems / linux-distro
Red Hat Inc.commercial · USaka redhat, red hat
- Red Hat Enterprise Linux ServerOSOn-premOperating Systems / linux-distro
mcafeecommercial · USaka mcaee, mcafee security
- web gatewaySecurity Products
xmlsoftoss-projectaka libxslt, libxml2
- libxml2LibraryLibraryOSS Libraries / generic-library

And 12 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable