PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112094 michaelrsweet CVE debrief

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Defenders should assess exposure and prioritize verification and potential patching of affected systems using mxml 4.0.5 and 4.0.6. The vulnerability can be exploited remotely, and defenders should verify affected versions and assess exposure.

Vendor
michaelrsweet
Product
mxml
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-19
Original CVE updated
2026-10-19
Advisory published
2026-10-19
Advisory updated
2026-10-19

Who should care

Defenders responsible for systems using mxml 4.0.5 and 4.0.6 should assess exposure and prioritize verification and potential patching. Defenders should prioritize verifying the affected versions 4.0.5 and 4.0.6 of mxml and assess exposure in their systems. The vulnerability can be exploited remotely, and defenders should verify affected versions and assess exposure.

Why it matters

The vulnerability in mxml 4.0.5 and 4.0.6 affects the function mxml_load_data, leading to a use after free vulnerability that can be exploited remotely.

  • Verify affected versions 4.0.5 and 4.0.6 of mxml in your systems
  • Assess exposure to the use after free vulnerability in mxml_load_data
  • Consider applying patches or mitigations provided by the vendor

Technical summary

The vulnerability affects the function mxml_load_data of the file mxml-file.c in mxml 4.0.5 and 4.0.6, leading to a use after free vulnerability that can be exploited remotely. The vulnerability was detected in mxml 4.0.5 and 4.0.6. The function mxml_load_data in mxml-file.c is affected by a use after free vulnerability. Defenders should prioritize verifying the affected versions 4.0.5 and 4.0.6 of mxml and assess exposure in their systems. The project was informed of the problem early through an issue report but has not responded yet.

Defensive priority

Defenders should prioritize verifying the affected versions 4.0.5 and 4.0.6 of mxml and assess exposure in their systems.

Recommended defensive actions

  • Verify the affected versions 4.0.5 and 4.0.6 of mxml in your systems
  • Assess exposure to the use after free vulnerability in mxml_load_data
  • Consider applying patches or mitigations provided by the vendor
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was detected in mxml 4.0.5 and 4.0.6. The function mxml_load_data in mxml-file.c is affected by a use after free vulnerability. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Defenders should verify affected versions and assess exposure in their systems. The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112094 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112094

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112094 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112094

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • michaelrsweet mxml mxml-file.c mxml_load_data use after free

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112094.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/421908

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/421908/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-112094

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1011796

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/michaelrsweet/mxml/issues/358

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/user-attachments/files/32836547/mxml-fix-354-358.patch

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/user-attachments/files/32701825/poc_mxml_error_handling.tar.gz

    Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.