CVE-2026-110604: Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
Published Oct 14, 2026
·Updated
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
Affected Software
1 affected component
Mini-XML Mini-XML>=4.0.0<=4.0.6
Event History
Oct 14, 2026
CVE Published
via MITRE·02:16 PM
Data Sourced
via MITRE·02:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions are required to trigger the issue?
The process must be using a locale whose decimal-point character is not '.'. An attacker must also be able to supply XML containing a REAL value with 63 digits followed by a period.
2
What impact should be expected from successful exploitation?
The flaw writes a NUL byte one byte past a 64-byte stack buffer. This can corrupt stack memory or crash the affected process.
3
Which releases are affected?
Mini-XML versions 4.0.0 through 4.0.6 are identified as affected.