CVE-2026-112094: michaelrsweet mxml mxml-file.c mxml_load_data use after free
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxmlloaddata of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which versions are identified as affected?
The reported affected versions are mxml 4.0.5 and 4.0.6. No fixed version is provided in the available information.
What access and interaction are required for exploitation?
The CVSS vector indicates the attack can be performed over the network, but requires low privileges and user interaction. It is therefore not described as an unauthenticated, no-interaction attack.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used. The project was reportedly notified through an issue report but had not responded at the time of the report.