CVE-2016-1835: Apple iPhone OS

High severity, CVSS 8.8. EPSS: 5.6% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.

Affected products

• Apple iPhone OS: up to and including 9.3.1
• Apple Mac OS X: up to and including 10.11.4
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only; version 16.04 only
• Debian Debian Linux: version 8.0 only

Published 2016-05-20. Last modified 2026-06-17.