LiveActive security incident?Get immediate response
CVE Record

CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag d...

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is an older XXE weakness in libxml2. A crafted XML document could make software that parses it read unintended local files, exposing sensitive data. The public bundle does not show CISA KEV listing or active exploitation evidence, so urgency is exposure-driven rather than incident-driven.

Executive priority

Treat this as a moderate-priority dependency remediation. Prioritize internet-facing or partner-facing XML processing and systems handling sensitive local files or credentials. The business risk is data exposure, not system takeover based on the provided evidence.

Technical view

libxml2 2.9.4 and earlier, including use through XMLSec 1.2.23 and earlier, lacked a direct flag to allow reading the current XML document while blocking other file opens. That made XXE-style confidentiality attacks easier when crafted XML was processed.

Likely exposure

Exposure is most likely in applications, services, or command workflows that parse untrusted XML using affected libxml2 or XMLSec versions, including OS-packaged dependencies. Systems that never process attacker-controlled XML have lower practical exposure.

Exploitation context

The source bundle says remote attackers could use a crafted document, but the CVSS vector requires user interaction and shows no integrity or availability impact. KEV is false, and no cited source in the bundle confirms active exploitation.

Researcher notes

The CVE maps to CWE-611. The affected CPE data in the bundle is incomplete, but the description names libxml2 2.9.4 and earlier and XMLSec 1.2.23 and earlier. Validate exposure by dependency path and XML trust boundary, not only product name.

Mitigation direction

  • Inventory libxml2 and XMLSec versions in operating systems, containers, and application dependencies.
  • Apply vendor security updates that address CVE-2016-9318 for affected distributions.
  • Restrict or disable external entity and external file access in XML parsers where supported.
  • Avoid processing untrusted XML with affected parsing stacks until updated or isolated.
  • Check vendor guidance if fixed package versions are unclear for your platform.

Validation and detection

  • Confirm installed libxml2 and XMLSec package versions against vendor advisories.
  • Identify services and jobs that parse XML from users, partners, email, or file uploads.
  • Review XML parser settings for external entity, file, and network access controls.
  • Check container images and static builds for bundled vulnerable library versions.
  • Verify remediation through package inventory and regression tests for XML-processing workflows.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-611: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2016-9318 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N1.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2016-9318Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-611

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.