CVE-2016-9840

HIGH

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Affects 21 products across 10 vendors.

CVSS 3.18.8
EPSS4.9%
Percentile92th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2017. A high severity vulnerability affects Apple systems (CVE-2016-9840). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2017-GLOBAL-237712-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2016-9840?
This vulnerability was disclosed in 2017. A high severity vulnerability affects Apple systems (CVE-2016-9840). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2016-9840?
CVE-2016-9840 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 4.9%.
Is CVE-2016-9840 actively exploited?
No confirmed active exploitation of CVE-2016-9840 as of 2026-10-09.
How do I remediate CVE-2016-9840?
Priority: MEDIUM. Advisory: https://cert-portal.siemens.com/productcert/html/ssa-470355.html
What systems are affected by CVE-2016-9840?
CVE-2016-9840 affects Apple Tvos, Mac Os X, Iphone Os, Watchos; Boost Boost; Canonical Ubuntu Linux; Debian Debian Linux; Nodejs Node.Js; Opensuse Leap, Opensuse (plus 11 more products across 4 more vendors).
Vulnerability Details
CVE IDCVE-2016-9840
BSIDBS-2017-GLOBAL-237712-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2026-07-21
Last Modified2026-10-08
ICS Relevance55%
SourceNVD
Official Description

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Apple Tvos < 11.0
Apple Mac Os X ≥ 10.0.0, < 10.13.0
Apple Iphone Os < 11
Apple Watchos < 4
Boost Boost < 1.78.0
Canonical Ubuntu Linux 16.04 18.04
Debian Debian Linux 8.0
Nodejs Node.Js ≥ 4.0.0, ≤ 4.1.2 ≥ 4.2.0, < 4.8.2 ≥ 6.0.0, ≤ 6.8.1 ≥ 6.9.0, < 6.10.2 ≥ 7.0.0, < 7.6.0
Opensuse Leap 42.1 42.2
Opensuse Opensuse 13.2
Oracle Mysql ≥ 5.5.0, ≤ 5.5.61 ≥ 5.6.0, ≤ 5.6.41 ≥ 5.7.0, ≤ 5.7.23 ≥ 8.0.0, ≤ 8.0.12
Oracle Database Server 18c
Oracle Jre 1.6.0 1.7.0 1.8.0
Oracle Jdk 1.6.0 1.7.0 1.8.0
Redhat Satellite 5.8
Redhat Enterprise Linux Eus 7.4 7.5
Redhat Enterprise Linux Workstation 6.0 7.0
Redhat Enterprise Linux Server 6.0 7.0
Redhat Enterprise Linux Desktop 6.0 7.0
Siemens CADRA < 2511
Zlib Zlib ≥ 1.2.0.6, < 1.2.9
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 86 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashca291839d46e7af93ed9d5eb28521d67fe1a3fdb222dfc7d702c969da8b7151f64fe2cb6e7869ad233ab69b6c682210e84f6e221b9468e5f8839d88e0c98c5ec
Related CVEs affecting Apple
CVE-2012-0751 10.0 The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before ... CVE-2011-2452 10.0 Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows,... CVE-2012-4151 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4153 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4159 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a...
View all Apple CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →