{"id":"CVE-2026-110604","revision":"6f11cfc565b94175abc904db1e8b1398","records":[{"revision":"6f11cfc565b94175abc904db1e8b1398","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110604","aliases":[],"title":"Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()","description":"Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.","state":0,"publishedAt":"2026-10-14T14:16:44.995+00:00","modifiedAt":"2026-10-14T16:19:42.263+00:00","affected":[{"ecosystem":"https://github.com/michaelrsweet/mxml","name":"Mini-XML","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Michael R Sweet\",\n                    \"product\": \"Mini-XML\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"4.0.0\",\n                            \"lessThanOrEqual\": \"4.0.6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"collectionURL\": \"https://github.com/michaelrsweet/mxml\",\n                    \"packageURL\": \"pkg:github/michaelrsweet/mxml\",\n                    \"repo\": \"https://github.com/michaelrsweet/mxml\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":2,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","score":3.6,"severity":"LOW"}],"references":["https://hackmd.io/@haind-pwn/mxml-strtod-locale-stack-overflow","https://github.com/michaelrsweet/mxml/blob/v4.0.6/mxml-file.c#L1860-L1887","https://github.com/michaelrsweet/mxml/commit/367c7ddd3387f65e867d776216de274bcaa3dae1","https://www.vulncheck.com/advisories/mini-xml-4.0.0-through-4.0.6-stack-out-of-bounds-write-via-mxml-strtod"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110604","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110604","identifiers":["CVE-2026-110604"]},"retained":false,"historicalAffected":[]}],"coverage":[]}