CVE-2016-2175

High severity vulnerability that affects org.apache.pdfbox:pdfbox

7.8 HighFix available

CVE-2016-2175 is a high vulnerability (CVSS 7.8) in Apache Pdfbox, published June 1, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.84%, the 90th percentile. Fixed in org.apache.pdfbox:pdfbox 1.8.12.

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.84%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: CVE-2016-2175
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: CVE-2016-2175
Updated: 2026-11-02

EUVDEUVD-2018-0498 No score

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: EUVD-2018-0498
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4c32-xmgj-2g98 7.8

High severity vulnerability that affects org.apache.pdfbox:pdfbox

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: GHSA-4c32-xmgj-2g98
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSV 7.8

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: CVE-2016-2175
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-2175 7.8

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: DEBIAN-CVE-2016-2175
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-4c32-xmgj-2g98 7.8

High severity vulnerability that affects org.apache.pdfbox:pdfbox

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: GHSA-4c32-xmgj-2g98
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-2175 7.8

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Record: UBUNTU-CVE-2016-2175
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0253 No score

Updated pdfbox packages fix security vulnerability

Apache PDFBox before 1.8.12 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF (CVE-2016-2175).

Record: MGASA-2016-0253
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10208-1 No score

apache-pdfbox-1.8.12-1.6 on GA media

These are all security issues fixed in the apache-pdfbox-1.8.12-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10208-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.pdfbox:pdfbox` Maven	before 1.8.12	1.8.12
`org.apache.pdfbox:pdfbox` Maven	2.0.0 to 2.0.0	2.0.1
`libpdfbox-java` Debian:12	before 1:1.8.12-1	1:1.8.12-1
`libpdfbox-java` Debian:13	before 1:1.8.12-1	1:1.8.12-1
`libpdfbox-java` Debian:14	before 1:1.8.12-1	1:1.8.12-1
`libpdfbox-java` Debian:7	before 1:1.7.0+dfsg-4+deb7u1, plus listed versions 1:1.7.0+dfsg-4	1:1.7.0+dfsg-4+deb7u1
`libpdfbox-java` Debian:8	before 1:1.8.7+dfsg-1+deb8u1, plus listed versions 1:1.8.7+dfsg-1	1:1.8.7+dfsg-1+deb8u1
`org.apache.pdfbox:pdfbox` Maven	before 1.8.12, plus listed versions 0.8.0-incubating0.8.0-incubator1.0.01.1.01.2.0 Show 19 moreShow less 1.2.11.3.11.4.01.5.01.6.01.7.01.7.11.8.01.8.11.8.101.8.111.8.21.8.31.8.41.8.51.8.61.8.71.8.81.8.9	1.8.12
`org.apache.pdfbox:pdfbox` Maven	2.0.0 up to 2.0.1	2.0.1
`pdfbox` Mageia:5	before 1.8.7-1.1.mga5	1.8.7-1.1.mga5
`libpdfbox-java` Ubuntu:16.04:LTS	All versions, plus listed versions 1:1.8.7+dfsg-11:1.8.10-11:1.8.10-21:1.8.11+dfsg-1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 18 moreShow less