Mini-XML EUVD-2026-86274

Requires an application or service that uses Mini-XML 4.0.5's mxml_load_data() to parse attacker-controlled XML. The specific trigger is XML that fails parsing after a text/value node is created but before it is linked to a parent (e.g., a value or empty element appearing where no parent exists), which routes control to the error cleanup path leaving the node orphaned. LIMITING FACTORS: impact is availability-only and cumulative - each malformed request leaks only a small allocation, so meaningful denial of service requires sustained, high-volume malformed input against a long-running process; a short-lived process that exits per-request reclaims the memory and is largely unaffected. No authentication is needed (PR:N), and exploitation does not depend on a non-default product configuration, only on the host application exposing XML parsing to untrusted input.

This is a moderate, availability-only issue (CWE-401 memory leak) rather than a top-tier emergency. The input CVSS of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates a remotely reachable, low-complexity, unauthenticated flaw affecting only availability, with no confidentiality or integrity impact. Corroborating signals point to low real-world urgency: EPSS is just 0.15% (4th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced - only an upstream issue and the fixing commit. Exploitation status is therefore 'no public exploit identified at time of analysis.' Two internal inconsistencies should be noted: (1) the input rates A:H (total availability loss), but the description makes clear the leak is gradual and cumulative ('on each parsing attempt'), so a single request has negligible impact and exhaustion requires sustained high-volume malformed requests against a long-lived process - this argues for A:L and a lower base score. (2) The input sets UI:R, yet the description frames the attack as 'repeated attacker-controlled requests,' implying a service that parses untrusted XML directly without a user action, which argues for UI:N. These do not raise the risk; they merely reclassify it as a slow resource-exhaustion DoS. Net: low operational priority - patch during normal maintenance unless Mini-XML parses untrusted input in an internet-facing, memory-constrained, long-running service.

An attacker repeatedly submits specially crafted malformed XML to a network-facing service that uses Mini-XML 4.0.5 to parse input via mxml_load_data(). Each parse failure orphans text nodes created by mxmlNewText() without freeing them, leaking a small amount of memory per request. Sustained over many requests, the cumulative leak exhausts process memory and causes denial of service. No public exploit code is referenced, but the trigger is trivial given the fixed upstream commit and issue #356.