Every CVE Search/ Get API key

CVE-2026-112094

michaelrsweet mxml mxml-file.c mxml_load_data use after free

5.1 MediumFix available

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.18%Unchanged since Oct 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

michaelrsweet mxml mxml-file.c mxml_load_data use after free

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
CVE-2026-112094
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CVSS 3.0
5.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CVSS 2.0
6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C
Weakness
CWE-416, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-104113 5.1

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
EUVD-2026-104113
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-2m37-39hv-427w 2.0

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the...

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
GHSA-2m37-39hv-427w
CVSS 4.0
2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 2.0

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
CVE-2026-112094
CVSS 4.0
2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSV 2.0

michaelrsweet mxml mxml-file.c mxml_load_data use after free

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
CVE-2026-112094
CVSS 4.0
2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-112094 2.0

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
DEBIAN-CVE-2026-112094
CVSS 4.0
2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-112094 2.0

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Record
UBUNTU-CVE-2026-112094
CVSS 4.0
2.0 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mxml
Debian:14
 before 4.0.6-3, plus listed versions
3.3.1-14.0.1-14.0.2-14.0.3-14.0.4-1
Show 6 moreShow less
4.0.4-34.0.4-44.0.4-54.0.4-64.0.5-14.0.6-2
4.0.6-3
mxml
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7-12.9-0ubuntu12.9-0ubuntu2
 None known
mxml
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.10-1
 None known
mxml
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.12-23.1-1
 None known
mxml
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2-13.3-1
 None known
mxml
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.3.1-13.3.1-1build1
 None known
mxml
Ubuntu:26.10
 All versions, plus listed versions
3.3.1-1build24.0.4-6
 None known
mxml
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.3.1-1build13.3.1-1build2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-112094 is a medium vulnerability (CVSS 5.1) in Michaelrsweet Mxml, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in mxml 4.0.6-3.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open