CVE-2026-112094
Received Received - Intake

Use After Free in mxml 4.0.5/4.0.6

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112094
EUVD
EUVD-2026-104113

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
michaelrsweet mxml 4.0.5
michaelrsweet mxml 4.0.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112094 is a use-after-free vulnerability in the Mini-XML (mxml) library versions 4.0.5 and 4.0.6. It occurs in the mxml_load_data function of mxml-file.c during error cleanup. When loading malformed XML data, the function attempts to delete nodes without proper checks, leading to double deletion. If the first node is a descendant of the second, the first deletion frees the second node, causing a use-after-free when the second node is later deleted again.

Detection Guidance

To detect this vulnerability, check if your system uses Mini-XML (mxml) versions 4.0.5 or 4.0.6. Inspect running processes for mxml-related applications and verify if they handle malformed XML inputs. Monitor for crashes or memory corruption errors during XML parsing operations.

Impact Analysis

This vulnerability can be exploited remotely by attackers sending crafted XML data. Successful exploitation may cause crashes, data corruption, or arbitrary code execution. Systems using affected mxml versions could experience service disruption or unauthorized access if the library processes malicious input.

Compliance Impact

This vulnerability, a use-after-free issue in mxml, could lead to arbitrary code execution or denial of service if exploited. For GDPR, this may risk unauthorized data access or processing, violating integrity and confidentiality principles. HIPAA compliance could be impacted if the vulnerability exposes protected health information due to system compromise or service disruption.

Mitigation Strategies

Immediately update Mini-XML to a patched version if available. If no patch exists, disable XML parsing features in applications using mxml or restrict input handling to trusted sources. Apply input sanitization to prevent malformed XML from triggering the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart