CVE-2023-42869 is a high severity (CVSS 7.5) entry for multiple memory corruption issues in libxml2 as shipped in Apple systems. Apple fixed them with improved input validation in macOS Ventura 13.4, iOS 16.5 and iPadOS 16.5. If a device is older than those releases, update it. Apps that bundle their own libxml2 need a separate check.
What's affected
The record lists iPadOS, iPhone OS and macOS as affected, and names the fixed releases as macOS Ventura 13.4, iOS 16.5 and iPadOS 16.5. Apple's bulletins for those two releases carry a libxml2 entry whose impact reads "Multiple issues in libxml2". The same entry credits OSS-Fuzz, the fuzzing project, with the find.
The weakness is CWE-787, an out-of-bounds write. The CVE was added to the bulletins on December 21, 2023, and the NVD record followed in January 2024.
Note what this does not say. Apple fixed its own copy of the library. Third-party apps and server software that statically link or bundle libxml2 carry their own copy, and an Apple update does not touch it. That is the part dependency scanning is good at.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Settings, General, Software Update shows whether a newer release is waiting.
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
For software you build or ship, look for libxml2 in your dependency tree. A lockfile or SBOM search is the fastest route. On a Linux build host, for example:
pkg-config --modversion libxml-2.0
prints the system library version, but container images and vendored copies need their own scan.
What to do now
- Update iPhones and iPads to iOS or iPadOS 16.5 or later, and Macs on Ventura to 13.4 or later.
- Search your applications, containers and SBOMs for bundled libxml2 and note the version each one carries.
- Rebuild images and apps that pin an old libxml2 against a current release.
- Prefer parsers configured to reject untrusted external content where the product allows it.
- Record the finding in your vulnerability tracker with the Apple fix versions, so reviewers can close it quickly.
Why it matters
libxml2 parses XML from files, network services and documents, so a memory bug in it is reachable from many products. The record's vector is network based with no account and no user interaction, and the impact is a high availability loss. That fits crashes of a process that parses untrusted XML, though Apple's text speaks only of memory corruption.
The class, CWE-787, is about writing past a buffer. It often starts as a crash and can become worse depending on the surrounding code. The KEV flag is false.
Because the library is so widely embedded, the practical task is an inventory: which of your products carry libxml2, and at what version.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does updating iOS fix my own app that bundles libxml2?
No. Apple patched its system copy. An app that ships its own libxml2 needs a rebuild against a fixed upstream release.
Sources
- Apple: About the security content of iOS 16.5 and iPadOS 16.5
- Apple: About the security content of macOS Ventura 13.4
Last reviewed: 19 October 2026.
