CVE-2026-110604 Details
Description
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
A stack buffer overflow vulnerability has been identified in Mini-XML versions 4.0.0 through 4.0.6. The issue arises in the mxml_strtod() function when the locale decimal point is not set to '.'. Under these conditions, the function can be tricked into writing a null byte beyond the bounds of a 64-byte stack buffer. This is achieved by supplying XML containing a 63-digit REAL value followed by a decimal point, which corrupts stack memory and can potentially crash the process.
Users can upgrade to Mini-XML version 4.0.7, which addresses the vulnerability by correcting the decimal point admission guard in the mxml_strtod() function. The updated version is available on the official Mini-XML GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-193 | Off-by-one Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mini-XML | >= 4.0.0, <= 4.0.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |