Stack-Based Buffer Overflow in Mini-XML

Executive Summary

CVE-2026-110604 is an off-by-one stack out-of-bounds write in Mini-XML's mxml_strtod() function. It occurs when the system locale uses a decimal point other than '.' (e.g., ',' in de_DE). Attackers can exploit this by providing an XML file with a 63-digit REAL value followed by a period, causing a NUL byte to be written past a 64-byte stack buffer. This corrupts stack memory or crashes the process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the Mini-XML version installed on your system using commands like 'mxml-config --version' or 'dpkg -l | grep mxml' on Debian-based systems. Review XML parsing functions in your applications for usage of mxml_strtod() or loader functions (mxmlLoadString, mxmlLoadFile). Enable AddressSanitizer during compilation to detect stack buffer overflows during runtime.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow attackers to corrupt stack memory or crash applications using Mini-XML 4.0.0-4.0.6. While it does not directly enable arbitrary code execution, it could lead to denial of service or instability in software parsing XML files with REAL values under non-'.' locales.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-severity memory corruption issue in XML parsing. It may indirectly impact compliance if exploited to crash systems processing sensitive data, but no evidence suggests data exposure or unauthorized access risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mini-XML to version 4.0.7 or later, which includes the fix for the buffer overflow in mxml_strtod(). If upgrading is not possible, avoid using Mini-XML in locales where the decimal point is not a period ('.'). Temporarily restrict XML parsing to trusted sources or disable XML parsing features until patched.

Useful 0 Not Useful 0