CVE-2026-112094: michaelrsweet mxml mxml-file.c mxml_load_data use after free

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-19
Weakness: CWE-119

Description

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

michaelrsweet mxml: 4.0.5, 4.0.6

References

https://github.com/michaelrsweet/mxml/
https://github.com/michaelrsweet/mxml/issues/358
https://github.com/user-attachments/files/32701825/poc_mxml_error_handling.tar.gz
https://github.com/user-attachments/files/32836547/mxml-fix-354-358.patch
https://vuldb.com/cve/CVE-2026-112094
https://vuldb.com/submit/1011796
https://vuldb.com/vuln/421908
https://vuldb.com/vuln/421908/cti

Get alerted when CVE-2026-112094 or the next vulnerability affects your stack