CVE-2026-88385 Details
Description
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.
A memory leak vulnerability has been identified in Mini-XML version 4.0.5, specifically within the mxml_load_data() function. This issue arises during the parsing of malformed XML, where specially crafted input can cause text nodes, created by mxmlNewText(), to become unlinked before a parse error redirects control to the cleanup process. As a result, these orphaned nodes are not properly released, leading to a persistent memory leak with each parsing attempt. When exploited through repeated attacker-controlled requests, this vulnerability can cause cumulative memory exhaustion, resulting in a denial-of-service condition.
Users can upgrade to Mini-XML version 4.0.6, which addresses the memory leak by improving error handling and cleanup during XML parsing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0 | [email protected] | Source CodeVendor |
| https://github.com/michaelrsweet/mxml/issues/356 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Mini-XML | 4.0.5 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |