CVE-2016-0718
Python 3.5 and 1 other: Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary…
CVE-2016-0718 is fixed in 6 products on 2 platforms, first by Python 3.6 3.6.2, released July 17, 2017. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
9.8
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1326
96th percentile
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.5 | 3.5.4 | Python 3.5 3.5.4 | Aug 7, 2017 |
| Python 3.6 | 3.6.2 | Python 3.6 3.6.2 | Jul 17, 2017 |
| Linux | |||
| expat · Ubuntu 24.10 (oracular) | 2.1.1-1ubuntu1 | expat 2.1.1-1ubuntu1 | Jan 16, 2026 |
| expat · Ubuntu 25.04 (plucky) | 2.1.1-1ubuntu1 | expat 2.1.1-1ubuntu1 | Jan 16, 2026 |
| libexpat1 · Ubuntu 24.10 (oracular) | 2.1.1-1ubuntu1 | libexpat1 2.1.1-1ubuntu1 | Jan 16, 2026 |
| libexpat1 · Ubuntu 25.04 (plucky) | 2.1.1-1ubuntu1 | libexpat1 2.1.1-1ubuntu1 | Jan 16, 2026 |
| libxmltok1 · Ubuntu 18.04.6 LTS (bionic) | 1.2-4ubuntu0.18.04.1~esm4 | libxmltok1 1.2-4ubuntu0.18.04.1~esm4 | Jan 10, 2022 |
| libxmltok1 · Ubuntu 20.04 LTS (focal) | 1.2-4ubuntu0.20.04.1~esm4 | libxmltok1 1.2-4ubuntu0.20.04.1~esm4 | Jan 10, 2022 |
| libxmltok1 · Ubuntu 22.04.1 LTS (jammy) | 1.2-4ubuntu0.22.04.1~esm4 | libxmltok1 1.2-4ubuntu0.22.04.1~esm4 | Jan 10, 2022 |
| libxmltok1t64 · Ubuntu 24.04.5 LTS (noble) | 1.2-4.1ubuntu2.24.0.4.1+esm2 | libxmltok1t64 1.2-4.1ubuntu2.24.0.4.1+esm2 | Jan 10, 2022 |
| libxmltok1t64 · Ubuntu 24.10 (oracular) | 1.2-4.1ubuntu3.1 | libxmltok1t64 1.2-4.1ubuntu3.1 | Sep 4, 2019 |