CVE-2016-5131

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-25)

CWE

CWE-416

Published

2016-07-23

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• apple:iphone_os
• apple:mac_os_x
• apple:tvos
• apple:watchos
• canonical:ubuntu_linux
• debian:debian_linux
• google:chrome
• opensuse:leap
• opensuse:opensuse
• redhat:enterprise_linux_desktop
• redhat:enterprise_linux_server
• redhat:enterprise_linux_workstation
• suse:linux_enterprise
• xmlsoft:libxml2

References

• http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html

Check your stackJSON