# CVE-2016-4472: Python 3.5 and 1 other: The overflow protection in Expat is removed by compilers with certain optimization settings, which allows…

CVE-2016-4472 is fixed in 4 products on 2 platforms, first by Python 3.6 3.6.2, released July 17, 2017. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2016-4472
- Priority: High
- CVSS: 8.1 (Medium)
- EPSS: 0.1195
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 17, 2016
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2016-4472

## Description

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Python 3.5 | 3.5.4 | [Python 3.5 3.5.4](https://patchblox.com/security/data/fix/windows-app/python.python.3.5-3.5.4.md) | Aug 7, 2017 |
| Windows apps | Python 3.6 | 3.6.2 | [Python 3.6 3.6.2](https://patchblox.com/security/data/fix/windows-app/python.python.3.6-3.6.2.md) | Jul 17, 2017 |
| Linux | libxmltok1 Ubuntu 18.04.6 LTS (bionic) | 1.2-4ubuntu0.18.04.1~esm4 | [libxmltok1 1.2-4ubuntu0.18.04.1~esm4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libxmltok1-1.2-4ubuntu0.18.04.1-esm4.md) | Jan 10, 2022 |
| Linux | libxmltok1 Ubuntu 20.04 LTS (focal) | 1.2-4ubuntu0.20.04.1~esm4 | [libxmltok1 1.2-4ubuntu0.20.04.1~esm4](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libxmltok1-1.2-4ubuntu0.20.04.1-esm4.md) | Jan 10, 2022 |
| Linux | libxmltok1 Ubuntu 22.04.1 LTS (jammy) | 1.2-4ubuntu0.22.04.1~esm4 | [libxmltok1 1.2-4ubuntu0.22.04.1~esm4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libxmltok1-1.2-4ubuntu0.22.04.1-esm4.md) | Jan 10, 2022 |
| Linux | libxmltok1t64 Ubuntu 24.04.5 LTS (noble) | 1.2-4.1ubuntu2.24.0.4.1+esm2 | [libxmltok1t64 1.2-4.1ubuntu2.24.0.4.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libxmltok1t64-1.2-4.1ubuntu2.24.0.4.1-esm2.md) | Jan 10, 2022 |
| Linux | libxmltok1t64 Ubuntu 24.10 (oracular) | 1.2-4.1ubuntu3.1 | [libxmltok1t64 1.2-4.1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxmltok1t64-1.2-4.1ubuntu3.1.md) | Sep 4, 2019 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo