CVE-2016-0718Critical· 9.8▾ Midnight

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score57/ 100 · Moderate

impact 53.9 · likelihood 2.7 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 26, 2016

Updated

Oct 8, 2026

CVSS

9.8

Vendor

mozilla

Product

firefox

CWE

CWE-119

Depth score

57 · Moderate

EPSS

13% · p96

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-08

Exploitation: none
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 8.

13% → 13%▼ 0.08%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 3787 days

May 26, 2016Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
13%

mozilla CWE-119 #nvd #cve.org

Affected

firefox < 48.0
mac_os_x >= 10.11.0, <= 10.11.5
linux_enterprise_debuginfo = 11
studio_onsite = 1.3
linux_enterprise_server = 11
linux_enterprise_software_development_kit = 11
leap = 42.1
linux_enterprise_desktop = 12
linux_enterprise_server = 12
linux_enterprise_software_development_kit = 12
ubuntu_linux = 12.04
ubuntu_linux = 14.04
ubuntu_linux = 16.04
libexpat < 2.2.0
debian_linux = 8.0
opensuse = 13.1
opensuse = 13.2
policy_auditor < 6.5.1
python >= 2.7.0, < 2.7.15
python >= 3.3.0, < 3.3.7
python >= 3.4.0, < 3.4.7
python >= 3.5.0, < 3.5.4
python >= 3.6.0, < 3.6.2

Patched in

firefox 48.0
libexpat 2.2.0
policy_auditor 6.5.1
python 3.6.2

Full technical detail▾

Overview

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Affected

firefox < 48.0
mac_os_x >= 10.11.0, <= 10.11.5
linux_enterprise_debuginfo = 11
studio_onsite = 1.3
linux_enterprise_server = 11
linux_enterprise_software_development_kit = 11
leap = 42.1
linux_enterprise_desktop = 12
linux_enterprise_server = 12
linux_enterprise_software_development_kit = 12
ubuntu_linux = 12.04
ubuntu_linux = 14.04
ubuntu_linux = 16.04
libexpat < 2.2.0
debian_linux = 8.0
opensuse = 13.1
opensuse = 13.2
policy_auditor < 6.5.1
python >= 2.7.0, < 2.7.15
python >= 3.3.0, < 3.3.7
python >= 3.4.0, < 3.4.7
python >= 3.5.0, < 3.5.4
python >= 3.6.0, < 3.6.2

Remediation

Upgrade past the affected range:

firefox 48.0
libexpat 2.2.0
policy_auditor 6.5.1
python 3.6.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org