CVE-2016-4463

HIGH

Apache Xerces-C++ < 3.1.4 - Denial of Service via Deeply Nested DTD

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-4463. PoCs published by arntsonl.

AI-analyzed exploit summary The repository contains a functional exploit for CVE-2016-4463, a stack-based buffer overflow in Apache Xerces-C++ before 3.1.4. The exploit generates a malformed XML file that triggers the overflow when parsed by vulnerable versions of Xerces-C++.

Description

Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.

Exploits (1)

nomisec WORKING POC

by arntsonl · poc

https://github.com/arntsonl/CVE-2016-4463

View Code ZIP pw:eip

The repository contains a functional exploit for CVE-2016-4463, a stack-based buffer overflow in Apache Xerces-C++ before 3.1.4. The exploit generates a malformed XML file that triggers the overflow when parsed by vulnerable versions of Xerces-C++.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: Apache Xerces-C++ 3.1.3 and below

No auth needed

Prerequisites: Vulnerable version of Apache Xerces-C++ · Ability to deliver the malformed XML file to the target

MITRE ATT&CK

T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (15)

Core 15

Core References

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2016/dsa-3610

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91501

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/538784/100/0/threaded

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/137714/Apache-Xerces-C-XML-Parser-Crash.html

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Various Sources x_refsource_confirm

https://issues.apache.org/jira/browse/XERCESC-2069

Various Sources x_refsource_confirm

https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10510&version=12336069

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:3335

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036211

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-09/msg00013.html

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:3506

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:3514

Various Sources x_refsource_confirm

http://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-07/msg00053.html

Vendor Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuapr2020.html

Scores

CVSS v3 7.5

EPSS 0.1425

EPSS Percentile 96.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-119

Status published

Products (2)

apache/xerces-c\+\+ < 3.1.3

debian/debian_linux 8.0

Published Jul 08, 2016

Tracked Since Feb 18, 2026