CVE-2026-88385: Mini-XML Mini-XML vulnerability
Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Mini-XML 4.0.5 that parse XML supplied or influenced by an attacker are exposed. The practical impact is greatest for long-running services that repeatedly process untrusted XML requests.
What does an attacker need to exploit it?
An attacker needs to submit specially crafted malformed XML that reaches mxml_load_data(). Repeated parsing attempts are needed to accumulate unreleased memory and exhaust available resources.
How can I tell whether my application is affected?
Check whether the application uses Mini-XML 4.0.5 and passes untrusted XML to mxml_load_data(). During testing, repeatedly submit malformed XML and monitor process memory for persistent growth after parse failures.