{"id":"CVE-2016-4658","title":"xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute…","summary":"xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-119"],"vendor":"xmlsoft","product":"libxml2","affected":["iphone_os < 10.0","mac_os_x < 10.12","tvos < 10.0","watchos < 3.0","libxml2 < 2.9.5"],"patched":["iphone_os 10.0","mac_os_x 10.12","tvos 10.0","watchos 3.0","libxml2 2.9.5"],"published":"2016-09-25","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:38.110","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-4658","references":[{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","label":"product-security@apple.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","label":"product-security@apple.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html","label":"product-security@apple.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html","label":"product-security@apple.com"},{"url":"http://www.securityfocus.com/bid/93054","label":"product-security@apple.com"},{"url":"http://www.securitytracker.com/id/1036858","label":"product-security@apple.com"},{"url":"http://www.securitytracker.com/id/1038623","label":"product-security@apple.com"},{"url":"https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b","label":"product-security@apple.com"},{"url":"https://security.gentoo.org/glsa/201701-37","label":"product-security@apple.com"},{"url":"https://support.apple.com/HT207141","label":"product-security@apple.com"},{"url":"https://support.apple.com/HT207142","label":"product-security@apple.com"},{"url":"https://support.apple.com/HT207143","label":"product-security@apple.com"},{"url":"https://support.apple.com/HT207170","label":"product-security@apple.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/93054","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1036858","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1038623","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201701-37","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT207141","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT207142","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT207143","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT207170","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.08559,"epssPercentile":0.94966,"ingestedAt":"2026-10-14T07:21:04.794Z","slug":"CVE-2016-4658","body":"## Overview\n\nxpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.\n\n## Affected\n\n- `iphone_os < 10.0`\n- `mac_os_x < 10.12`\n- `tvos < 10.0`\n- `watchos < 3.0`\n- `libxml2 < 2.9.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `iphone_os 10.0`\n- `mac_os_x 10.12`\n- `tvos 10.0`\n- `watchos 3.0`\n- `libxml2 2.9.5`","depth":"midnight","depthScore":56,"depthScoreParts":{"impact":53.9,"likelihood":1.7,"exploitation":0,"ransomware":0},"changes":[]}