CVE-2026-110604
Low
Description
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
SeverityLow
CVSS3.6
Exploit probability—
ProductMini-XML
PublishedOct 14, 2026
First seenOct 14, 2026
Weakness typeCWE-193CWE-193
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Michael R Sweet Mini-XML | 4.0.0 ≤ v ≤ 4.0.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.