Live › vulnerability › CVE-2026-112094
Go to dashboardMini-XML (mxml) versions 4.0.5 and 4.0.6 have a use-after-free in the mxml_load_data function in mxml-file.c. The sources say an attacker can trigger it remotely and that a public exploit has been disclosed, but they do not state the resulting code execution or data access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that link Mini-XML 4.0.5 or 4.0.6 and parse XML that may come from untrusted sources through mxml_load_data are potentially exposed. The sources do not say which configurations or entry points are reachable, so whether a given service is exposed is unknown. Systems that do not use mxml or do not run these versions can skip it.
No product ranges from the sources yet.
mxmldoc --version or by inspecting the library version in your build (unknown if the sources give a command).mxml at 4.0.5 or 4.0.6.4.0.5 and 4.0.6; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112094")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.