---
id: "CVE-2026-112094"
kind: "vulnerability"
aliases: ["CVE-2026-112094"]
title: "Mini-XML: use-after-free in mxml_load_data lets remote attackers corrupt memory"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "embedded", "mxml", "package", "xml-parsing"]
not_affected_if: ["unknown"]
published_at: "2026-10-19T08:17:03+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112094", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Mini-XML: use-after-free in mxml_load_data lets remote attackers corrupt memory

Mini-XML (mxml) versions 4.0.5 and 4.0.6 have a use-after-free in the mxml_load_data function in mxml-file.c. The sources say an attacker can trigger it remotely and that a public exploit has been disclosed, but they do not state the resulting code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mini-XML version with `mxmldoc --version` or by inspecting the library version in your build (unknown if the sources give a command).
- Search your dependencies for `mxml` at `4.0.5` or `4.0.6`.

## Fix

- Upgrade past the affected versions `4.0.5` and `4.0.6`; the sources do not name a fixed version.
- The project had not responded at the time of reporting, so check the upstream repository for a patch.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112094

## From the sources

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_