Michael R Sweet CVE debriefs

CVE-2026-110604

A low-severity vulnerability exists in Mini-XML versions 4.0.0 through 4.0.6, where an off-by-one stack out-of-bounds write occurs in the mxml_strtod() function when the locale decimal point is not '.'. This issue allows attackers to supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, potentially corrupting stack memory or crashing the process.