{"id":"CVE-2026-112094","kind":"vulnerability","aliases":["CVE-2026-112094"],"related":[],"title":"Mini-XML: use-after-free in mxml_load_data lets remote attackers corrupt memory","description":"A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Mini-XML (mxml) versions 4.0.5 and 4.0.6 have a use-after-free in the mxml_load_data function in mxml-file.c. The sources say an attacker can trigger it remotely and that a public exploit has been disclosed, but they do not state the resulting code execution or data access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","embedded","mxml","package","xml-parsing"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Mini-XML version with `mxmldoc --version` or by inspecting the library version in your build (unknown if the sources give a command).\n- Search your dependencies for `mxml` at `4.0.5` or `4.0.6`.","fix":"- Upgrade past the affected versions `4.0.5` and `4.0.6`; the sources do not name a fixed version.\n- The project had not responded at the time of reporting, so check the upstream repository for a patch.","status":"open","published_at":"2026-10-19T08:17:03+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:17+00:00","updated_at":"2026-10-25T03:57:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade past the affected versions `4.0.5` and `4.0.6`; the sources do not name a fixed version.\n- The project had not responded at the time of reporting, so check the upstream repository for a patch.","reach":"network","title":"Mini-XML: use-after-free in mxml_load_data lets remote attackers corrupt memory","impact":"medium","summary":"Mini-XML (mxml) versions 4.0.5 and 4.0.6 have a use-after-free in the mxml_load_data function in mxml-file.c. The sources say an attacker can trigger it remotely and that a public exploit has been disclosed, but they do not state the resulting code execution or data access.","category":"package","nicknames":[],"who_cares":["c","embedded","mxml","xml-parsing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Memory corruption from remote input; code execution not confirmed by sources","analyst_note":"Confirm the fixed version and whether the upstream project has responded; check the NVD entry for the exploit reference and whether the attack vector is unauthenticated.","how_to_check":"- Check the installed Mini-XML version with `mxmldoc --version` or by inspecting the library version in your build (unknown if the sources give a command).\n- Search your dependencies for `mxml` at `4.0.5` or `4.0.6`.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Applications that link Mini-XML 4.0.5 or 4.0.6 and parse XML that may come from untrusted sources through mxml_load_data are potentially exposed. The sources do not say which configurations or entry points are reachable, so whether a given service is exposed is unknown. Systems that do not use mxml or do not run these versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":3340,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112094':19A,22A '-2026':18A,21A '/4.0.6':94C '4.0.5':35B,93C '4.0.6':37B 'access':83B 'affect':96C 'attack':14A,59B,117C 'c':23B,54B,108C 'carri':122C 'code':79B 'corrupt':15A 'cve':17A,20A 'data':11A,48B,82B,101C 'detect':89C 'disclos':71B,129C 'earli':142C 'embed':24B 'execut':80B 'exploit':68B,126C 'file':53B,104C,107C 'free':7A,43B,115C 'function':49B,98C 'inform':138C 'issu':145C 'lead':111C 'let':12A 'load':10A,47B,100C 'manipul':110C 'may':132C 'memori':16A 'michaelrsweet':91C 'mini':2A,31B 'mini-xml':1A,30B 'mxml':9A,25B,33B,46B,52B,92C,99C,106C 'mxml-file':51B,105C 'packag':26B 'pars':29B 'possibl':119C 'problem':141C 'project':136C 'public':67B,130C 'remot':13A,63B,124C 'report':146C 'respond':150C 'result':78B 'say':57B 'secur':85C 'sourc':56B 'state':76B 'trigger':61B 'use':5A,41B,113C,134C 'use-after-fre':4A,40B 'version':34B 'vulner':86C 'xml':3A,28B,32B 'xml-pars':27B 'yet':151C","nicknames":[],"mitigations":[],"who_affected":"Applications that link Mini-XML 4.0.5 or 4.0.6 and parse XML that may come from untrusted sources through mxml_load_data are potentially exposed. The sources do not say which configurations or entry points are reachable, so whether a given service is exposed is unknown. Systems that do not use mxml or do not run these versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T08:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112094","severity":null,"published_at":"2026-10-19T08:17:03+00:00","modified_at":"2026-10-19T18:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}