CVE-2016-1762: Apple iPhone OS

High severity, CVSS 8.1. EPSS: 6.5% chance of exploitation in the next 30 days.

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Affected products

• Apple iPhone OS: before 9.3 (fixed in 9.3)
• Apple Mac OS X: before 10.11.4 (fixed in 10.11.4)
• Apple Safari: before 9.1 (fixed in 9.1)
• Apple tvOS: before 9.2 (fixed in 9.2)
• Apple watchOS: before 2.2 (fixed in 2.2)
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only; version 16.04 only
• Debian Debian Linux: version 8.0 only
• McAfee Web Gateway: up to and including 7.5.2.10; after 7.5.2.11, up to and including 7.6.2.3
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.2 only; version 7.3 only; version 7.4 only; version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.2 only; version 7.3 only; version 7.4 only; version 7.5 only; version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.2 only; version 7.3 only; version 7.6 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only
• Xmlsoft LIBXML2: before 2.9.4 (fixed in 2.9.4)

Published 2016-03-24. Last modified 2026-06-17.