CVE-2026-112094

CVSS 5.5 (medium) · published 2026-10-19

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Weakness: CWE-119, CWE-416

Source: NVD CVE-2026-112094

References

• https://github.com/michaelrsweet/mxml/
• https://github.com/michaelrsweet/mxml/issues/358
• https://github.com/user-attachments/files/32701825/poc_mxml_error_handling.tar.gz
• https://github.com/user-attachments/files/32836547/mxml-fix-354-358.patch
• https://vuldb.com/cve/CVE-2026-112094
• https://vuldb.com/submit/1011796
• https://vuldb.com/vuln/421908
• https://vuldb.com/vuln/421908/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.