Mini-XML CVE-2026-110604

Exploitation requires that the host process runs under a C locale whose decimal point is NOT '.' (e.g., de_DE, fr_FR, or any comma-decimal locale) - in a default 'C'/en_US locale the vulnerable branch is not reached. The application must then parse attacker-controlled XML containing a REAL numeric value of exactly 63 digits immediately followed by a '.' character, which drives mxml_strtod()'s decimal-point substitution logic to write one byte past its 64-byte stack buffer. Limiting factors: the non-default locale precondition, the requirement that the attacker's data reaches the XML parser (UI:P / local delivery), and the single-byte NUL overwrite that constrains impact mostly to crashes or minor stack corruption rather than reliable control-flow hijack.

All available signals point to a low real-world priority. The vendor-assigned CVSS 4.0 base score is only 2.0, consistent with a vector that requires local attack delivery (AV:L), a non-default attack requirement (AT:P - the process locale's decimal point must not be '.'), passive user interaction (UI:P), and yields only limited integrity and availability impact (VI:L/VA:L) with no confidentiality loss - matching an off-by-one that writes a single NUL byte past a 64-byte stack buffer (CWE-193). No EPSS score, KEV listing, or SSVC decision data was provided, so probabilistic exploitation and automatability cannot be weighed; absence of these is not evidence of safety but does mean there is no signal of mass exploitation. There is no indication of active exploitation and no POC flag in the input, though a detailed public technical write-up by the reporting researcher is referenced, which lowers the research bar for a working trigger. The realistic worst case is a denial of service (process crash) or localized stack corruption rather than reliable code execution, since only one NUL byte is written out of bounds. Net: a genuine but minor bug - patch in routine maintenance cycles, not an emergency.

An application linked against Mini-XML 4.0.0-4.0.6 runs in a locale whose decimal separator is not '.' (e.g., de_DE, fr_FR) and parses attacker-controlled XML. The attacker submits a REAL value consisting of 63 digits followed by '.', causing mxml_strtod() to write a terminating NUL one byte past its 64-byte stack buffer, typically crashing the process or corrupting adjacent stack memory. No weaponized exploit is published, but a public technical write-up documenting the flaw exists.