CVE-2016-2099: Apache Xerces-C++

Critical severity, CVSS 9.8. EPSS: 6.8% chance of exploitation in the next 30 days.

Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.

Affected products

• Apache Xerces-C++: up to and including 3.1.3
• Opensuse Opensuse: version 13.2 only

Published 2016-05-13. Last modified 2026-06-17.