CVE-2026-112094
michaelrsweet mxml mxml-file.c mxml_load_data use after free
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 19, 2026
- Reserved
- Oct 18, 2026
Description
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 5.5 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
mxmlmichaelrsweet |
|
References
- VDB-421908 | michaelrsweet mxml mxml-file.c mxml_load_data use after freevdb-entrytechnical-description
- VDB-421908 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-112094 | CVE Analysis and Reportthird-party-advisory
- Submit #1011796 | mxml v4.0.5, v4.0.6 Use After Freethird-party-advisory
- https://github.com/michaelrsweet/mxml/issues/358issue-tracking
- https://github.com/user-attachments/files/32836547/mxml-fix-354-358.patchpatch
- https://github.com/user-attachments/files/32701825/poc_mxml_error_handling.tar.gzexploit
- https://github.com/michaelrsweet/mxml/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.