CVE-2016-9063
Python 3.5 and 1 other: An integer overflow during the parsing of XML using the Expat library.
CVE-2016-9063 is fixed in 3 products on 2 platforms, first by Python 3.6 3.6.2, released July 17, 2017. It is not reported as exploited. Patch Radar priority: Urgent.
UrgentFixed on 2 platforms
CVSS
9.8
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0536
92nd percentile
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.5 | 3.5.4 | Python 3.5 3.5.4 | Aug 7, 2017 |
| Python 3.6 | 3.6.2 | Python 3.6 3.6.2 | Jul 17, 2017 |
| Linux | |||
| expat · sles 15.6 | 2.8.5-150400.3.40.1 | SUSE-SU-2026:4623-1 | Nov 7, 2026 |