CVE-2026-110604 Michael R Sweet CVE debrief

Who should care

Defenders responsible for systems or applications using Mini-XML versions 4.0.0 through 4.0.6 should assess the exposure of their environment to this vulnerability and prioritize verification and potential remediation.

Why it matters

This low-severity vulnerability in Mini-XML can lead to potential stack memory corruption or process crashes. Defenders should verify the affected versions in their environment, assess the feasibility of exploitation, and prioritize remediation.

• Potential stack memory corruption or process crashes.
• Verification of affected versions and locale configurations is necessary.
• Remediation may require updating to a fixed version of Mini-XML.

Technical summary

The mxml_strtod() function in Mini-XML versions 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write vulnerability when the locale decimal point is not '.'. This can be exploited by supplying XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer. The vulnerability can lead to potential stack memory corruption or process crashes. Defenders should verify the affected versions in their environment, assess the feasibility of exploitation, and prioritize remediation.

Defensive priority

Defenders should prioritize verifying the affected versions of Mini-XML in their environment and assessing the feasibility of exploitation.

Recommended defensive actions

• Verify the version of Mini-XML in use and check if it falls within the affected range (4.0.0 through 4.0.6).
• Assess the feasibility of exploitation in the environment.
• Apply the patch provided by the vendor, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Additional details are available from various source references, including technical descriptions, patches, and third-party advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.