Every CVE Search/ Get API key

CVE-2026-5037

mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow

4.8 MediumFix available

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.13%Up 0.1 points since Mar 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
CVE-2026-5037
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-121, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-16983 4.8

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
EUVD-2026-16983
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-2j9m-mc98-jvp7 1.9

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of...

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
GHSA-2j9m-mc98-jvp7
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 1.9

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
CVE-2026-5037
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-119, CWE-121
Updated
2026-11-02
OSV 1.9

mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
CVE-2026-5037
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-121
Updated
2026-11-02
OSVDEBIAN-CVE-2026-5037 1.9

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
DEBIAN-CVE-2026-5037
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-1860 3.3

mxml security update

Mini-XML is a small XML parsing library that you can use to read XML and XML-like data files in your application without requiring large non-standard libraries.

Security Fix(es):

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.(CVE-2026-5037)

Record
OESA-2026-1860
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5037 1.9

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Record
UBUNTU-CVE-2026-5037
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
mxml
Debian:12
 before 3.3.1-1+deb13u1~deb12u1, plus listed versions
3.3.1-1
3.3.1-1+deb13u1~deb12u1
mxml
Debian:13
 before 3.3.1-1+deb13u1, plus listed versions
3.3.1-13.3.1-1+deb13u1~deb12u1
3.3.1-1+deb13u1
mxml
Debian:14
 before 4.0.4-4, plus listed versions
3.3.1-14.0.1-14.0.2-14.0.3-14.0.4-14.0.4-3
4.0.4-4
mxml
openEuler:24.03-LTS-SP3
 before 3.3.1-2.oe2403sp3
3.3.1-2.oe2403sp3
mxml
openEuler:20.03-LTS-SP4
 before 3.2-2.oe2003sp4
3.2-2.oe2003sp4
mxml
openEuler:22.03-LTS-SP4
 before 3.2-2.oe2203sp4
3.2-2.oe2203sp4
mxml
openEuler:24.03-LTS
 before 3.3.1-2.oe2403sp2
3.3.1-2.oe2403sp2
mxml
openEuler:24.03-LTS-SP1
 before 3.3.1-2.oe2403sp1
3.3.1-2.oe2403sp1
mxml
openEuler:24.03-LTS-SP2
 before 3.3.1-2.oe2403sp2
3.3.1-2.oe2403sp2
mxml
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7-12.9-0ubuntu12.9-0ubuntu2
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
mxml
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.10-1
 None known
mxml
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.12-23.1-1
 None known
mxml
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2-13.3-1
 None known
mxml
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.3.1-13.3.1-1build1
 None known
mxml
Ubuntu:25.10
 All versions, plus listed versions
3.3.1-1build1
 None known
mxml
Ubuntu:26.10
 All versions, plus listed versions
3.3.1-1build24.0.4-6
 None known
mxml
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.3.1-1build13.3.1-1build2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5037 is a medium vulnerability (CVSS 4.8) in mxml, published March 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in mxml 3.3.1-1+deb13u1~deb12u1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open