Skip to content

CVE-2016-4216

Moderate severity vulnerability that affects com.adobe.xmp:xmpcore

7.5 HighFix available

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

3.63%Up 2.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Record: CVE-2016-4216
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Record: CVE-2016-4216
Updated: 2026-11-02

EUVDEUVD-2018-0668 No score

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Record: EUVD-2018-0668
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qv32-7r6p-xhhh 7.5

Moderate severity vulnerability that affects com.adobe.xmp:xmpcore

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Record: GHSA-qv32-7r6p-xhhh
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-611
Updated: 2026-11-02

OSVGHSA-qv32-7r6p-xhhh 7.5

Moderate severity vulnerability that affects com.adobe.xmp:xmpcore

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Record: GHSA-qv32-7r6p-xhhh
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-611
Updated: 2026-11-02

OSVOESA-2026-1319 7.5

xmpcore security update

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Security Fix(es):

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.(CVE-2016-4216)

Record: OESA-2026-1319
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 6 moreShow less

OSVOESA-2026-1366 7.5

xmpcore security update

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Security Fix(es):

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.(CVE-2016-4216)

Record: OESA-2026-1366
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-1367 7.5

xmpcore security update

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Security Fix(es):

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.(CVE-2016-4216)

Record: OESA-2026-1367
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-1368 7.5

xmpcore security update

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Security Fix(es):

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.(CVE-2016-4216)

Record: OESA-2026-1368
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-1369 7.5

xmpcore security update

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Security Fix(es):

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.(CVE-2016-4216)

Record: OESA-2026-1369
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-1370 7.5

xmpcore security update

The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

Security Fix(es):

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.(CVE-2016-4216)

Record: OESA-2026-1370
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-4216 7.5

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Record: UBUNTU-CVE-2016-4216
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

adobe xmp toolkit

Affected packages

Affected packages
Package	Affected	Fixed
`com.adobe.xmp:xmpcore` Maven	before 5.1.3	5.1.3
`com.adobe.xmp:xmpcore` Maven	before 5.1.3, plus listed versions 5.1.05.1.15.1.2	5.1.3
`xmpcore` openEuler:24.03-LTS-SP1	before 6.1.10-1.oe2403sp1	6.1.10-1.oe2403sp1
`xmpcore` openEuler:24.03-LTS-SP2	before 6.1.10-1.oe2403sp2	6.1.10-1.oe2403sp2
`xmpcore` openEuler:24.03-LTS-SP3	before 6.1.10-1.oe2403sp3	6.1.10-1.oe2403sp3
`xmpcore` openEuler:20.03-LTS-SP4	before 6.1.10-1.oe2003sp4	6.1.10-1.oe2003sp4
`xmpcore` openEuler:22.03-LTS-SP4	before 6.1.10-1.oe2203sp4	6.1.10-1.oe2203sp4
`xmpcore` openEuler:24.03-LTS	before 6.1.10-1.oe2403	6.1.10-1.oe2403
`libxmpcore-java` Ubuntu:16.04:LTS	All versions, plus listed versions 5.1.2-3	None known
`libxmpcore-java` Ubuntu:18.04:LTS	All versions, plus listed versions 5.1.2-3	None known

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`libxmpcore-java` Ubuntu:20.04:LTS	before 5.1.3-1	5.1.3-1
`libxmpcore-java` Ubuntu:22.04:LTS	before 5.1.3-1	5.1.3-1
`libxmpcore-java` Ubuntu:24.04:LTS	before 5.1.3-1	5.1.3-1
`libxmpcore-java` Ubuntu:25.10	before 5.1.3-1	5.1.3-1
`libxmpcore-java` Ubuntu:26.04:LTS	before 5.1.3-1	5.1.3-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4216 is a high vulnerability (CVSS 7.5) in Adobe Xmp Toolkit, published July 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.63%, the 89th percentile. Fixed in com.adobe.xmp:xmpcore 5.1.3.

References

Show 6 moreShow less