Mini-XML CVE-2026-112094

Requires the target to run Mini-XML 4.0.5 or 4.0.6 AND for a consuming application to pass attacker-controlled XML into mxml_load_data such that the malformed-input error-handling path is reached, which is where the freed memory is reused. Limiting factors: this is a library bug, so there is no attack surface unless an application exposes mxml parsing to untrusted input; the CVSS vector requires user/application interaction (UI:P) to load the crafted document, and the demonstrated impact is primarily a crash/denial of service rather than confirmed remote code execution. No official vendor patch is available (project unresponsive), so mitigation currently depends on the referenced community patch or restricting untrusted XML input.

This is a low-priority, high-noise finding rather than a genuine emergency. The only quantitative signal is a VulDB-authored CVSS 4.0 base score of 2.0 (Low), with vulnerable-system impacts all rated Low (VC:L/VI:L/VA:L) and exploit maturity marked Proof-of-Concept (E:P) - consistent with the publicly posted POC. No EPSS score and no CISA KEV entry were provided, so there is no evidence of widespread or targeted active exploitation; exploitation status is best described as 'publicly available exploit code exists,' which is distinct from in-the-wild use. The CVSS 4.0 vector claims a network attack vector (AV:N) but requires user interaction (UI:P) and low privileges (PR:L); because mxml is a parsing LIBRARY, 'remote/network' only holds if the embedding application exposes mxml_load_data to attacker-supplied XML - verify against the actual deployment. Signals are internally consistent (low score, PoC-only, no KEV, DoS-oriented impact) but two metadata conflicts should be noted: the CWE is CWE-119 and a 'Buffer Overflow' tag is applied, yet the description explicitly states a use-after-free (more accurately CWE-416), and the realistic impact per the POC name ('error_handling') is a crash/DoS rather than reliable code execution.

An application built on Mini-XML 4.0.5/4.0.6 ingests a malformed XML document from an attacker; during the error-handling path of mxml_load_data in mxml-file.c, previously freed memory is reused, crashing the consuming process or potentially corrupting memory. A public proof-of-concept archive (poc_mxml_error_handling.tar.gz) demonstrates the condition, so the trigger is reproducible, though reaching it requires the host application to feed the crafted XML into the parser (UI:P).