CVE-2026-88385

Deferred Deferred - Pending Action

Memory Leak in Mini-XML XML Parsing

Publication date: 2026-09-24

Last updated on: 2026-10-06

Assigner: MITRE

Description

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-06

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-88385

EUVD

EUVD-2026-86274

Affected Vendors & Products

Vendor	Product	Version / Range
michaelrsweet	mini-xml	4.0.5
michaelrsweet	mini-xml	4.0.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

Mini-XML 4.0.5 has a memory leak in mxml_load_data() when parsing malformed XML. Crafted XML input causes text nodes created by mxmlNewText() to become unlinked during error handling. These nodes are not freed, leading to memory leaks on each parsing attempt.

Detection Guidance

Memory leaks from this vulnerability can be detected by monitoring system memory usage during XML parsing operations. Look for unaccounted memory growth when processing XML files. Tools like Valgrind can track memory allocations and leaks during mxml_load_data() execution.

Impact Analysis

Repeated exploitation can exhaust system memory, causing performance degradation or crashes. This may lead to denial of service for applications using Mini-XML 4.0.5, disrupting services dependent on XML parsing.

Compliance Impact

This vulnerability primarily causes memory leaks during XML parsing, which could lead to denial-of-service conditions due to resource exhaustion. While not directly related to data privacy or security controls, prolonged denial-of-service could impact system availability, potentially affecting compliance with availability requirements in standards like HIPAA (for healthcare systems) or GDPR (for service continuity). However, the vulnerability does not directly expose or leak sensitive data.

Mitigation Strategies

Upgrade to a patched version of Mini-XML beyond 4.0.5. If upgrading is not immediately possible, implement strict input validation for all XML parsing operations to reject malformed XML before processing. Monitor memory usage for signs of leaks during XML operations.

Hi! I’m here to help you understand CVE-2026-88385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70