CVE-2015-1646: Microsoft XML Core Services

Medium severity, CVSS 4.3. EPSS: 16.9% chance of exploitation in the next 30 days.

Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB Vulnerability."

Affected products

• Microsoft XML Core Services: version 3.0 only

Published 2015-04-14. Last modified 2026-06-17.