Is SAP Crystal Reports XI use MSXML 4.0?

Our vulnerability scan detected and old version of msxml4.dll

Is CR XI using this library or it can be replaced by newer version?