CVE-2016-2099

Critical

Published: 13/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.

Risk Assessment

Attackers may exploit this vulnerability to inject malicious code or disrupt the operation of applications processing XML documents, potentially leading to data loss or system integrity breaches.

Recommendation

It is recommended to upgrade to the latest version of Apache Xerces C++ to mitigate this vulnerability and to conduct a security audit of applications processing XML.

Original NVD description (English source)

Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.