Is CVE-2016-4448 being actively exploited?

CVE-2016-4448 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2016-4448?

CVE-2016-4448 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2016-4448

CRITICAL · CVSS 9.8EPSS 7.0%EU EUVD

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-134
EPSS score: 7.0% (94th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2016-5437)
Published: June 9, 2016
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-5437 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

apple / icloud
apple / iphone os
apple / itunes
apple / mac os x
apple / tvos
apple / watchos
hp / icewall federation agent
mcafee / web gateway
microsoft / windows
microsoft / windows
oracle / linux
oracle / linux
oracle / vm server
oracle / vm server
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server eus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux workstation
redhat / enterprise linux workstation
slackware / slackware linux
slackware / slackware linux
tenable / log correlation engine
xmlsoft / libxml2

Certified products that may be affected

10 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Oracle Linux 7 Unbreakable Enterprise Kernel (UEK 6) Cryptographic Module - Oracle Corporation - FIPS 140 4169 - historical
Red Hat Enterprise Linux 7.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11039-2020 - archived
Oracle Linux 6 Kernel Crypto API Cryptographic Module - Oracle Corporation - FIPS 140 3421 - historical
Oracle Linux 6 Libreswan Cryptographic Module - Oracle Corporation - FIPS 140 3170 - historical
Oracle Linux 6 NSS Cryptographic Module - Oracle Corporation - FIPS 140 3111 - historical

See all 10 in the Security Certifications Explorer.

References

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html(Mailing List, Release Notes)
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html(Mailing List, Release Notes)
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html(Mailing List, Release Notes)
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html(Mailing List, Release Notes)
http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html(Mailing List, Release Notes)
http://rhn.redhat.com/errata/RHSA-2016-2957.html(Third Party Advisory)
http://www.openwall.com/lists/oss-security/2016/05/25/2(Mailing List, Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html(Vendor Advisory)
http://www.securityfocus.com/bid/90856(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1036348(Third Party Advisory, VDB Entry)
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722(Third Party Advisory)
http://xmlsoft.org/news.html(Release Notes)
https://access.redhat.com/errata/RHSA-2016:1292(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1338700(Issue Tracking, Third Party Advisory)
https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9(Vendor Advisory)
https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b(Vendor Advisory)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709(Third Party Advisory)
https://kc.mcafee.com/corporate/index?page=content&id=SB10170(Third Party Advisory)
https://support.apple.com/HT206899(Release Notes)
https://support.apple.com/HT206901(Release Notes)
https://support.apple.com/HT206902(Release Notes)
https://support.apple.com/HT206903(Release Notes)
https://support.apple.com/HT206904(Release Notes)
https://support.apple.com/HT206905(Release Notes)
https://www.tenable.com/security/tns-2016-18(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain