CVE-2026-110604 in Mini-XML
Summary
by MITRE • 10/14/2026
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Mini-XML versions 4.0.0 through 4.0.6 represents a critical stack-based buffer overflow resulting from an off-by-one error within the mxml_strtod() function. This specific flaw is triggered under non-standard locale configurations where the decimal point character differs from the standard period (dot). The core technical issue arises during the parsing of REAL values, specifically when the input string contains a 63-digit integer part followed by a localized decimal separator and subsequent digits. In such scenarios, the internal logic responsible for converting the string representation to a double-precision floating-point number miscalculates the required buffer space or index bounds. This miscalculation leads to a write operation that extends one byte beyond the allocated 64-byte stack buffer. The consequence of this out-of-bounds write is the corruption of adjacent memory on the call stack, which typically contains return addresses, saved frame pointers, and other critical control data structures essential for program execution flow.
From an operational perspective, this vulnerability poses a severe risk to application stability and potential remote code execution capabilities depending on the context in which Mini-XML is deployed. If the affected library is used within a network-facing service that processes untrusted XML input, an attacker can craft malicious payloads designed to exploit this memory corruption. By carefully controlling the stack layout through subsequent inputs or heap spraying techniques, it may be possible to overwrite critical control flow indicators such as return addresses. This could allow for arbitrary code execution with the privileges of the vulnerable process. Even in cases where exploitation is not feasible due to modern mitigations like Stack Canaries or Address Space Layout Randomization, the vulnerability remains a significant denial-of-service vector. The corruption of stack memory inevitably leads to application crashes, disrupting service availability and potentially causing data loss if stateful operations are interrupted abruptly.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-120, which describes buffer copy without checking size limits, specifically manifesting here as a classic off-by-one error leading to stack-based buffer overflow. In the context of the MITRE ATT&CK framework, this vulnerability facilitates initial access and execution techniques by allowing attackers to manipulate program control flow through memory corruption. The specific trigger condition related to locale settings highlights the importance of internationalization security considerations in software development. Developers often assume standard ASCII behavior for numeric parsing, but failing to account for regional variations can introduce subtle yet exploitable logic errors that bypass basic input validation checks which might otherwise reject malformed numbers based on character set alone.
To mitigate this vulnerability, organizations must immediately upgrade Mini-XML to version 4.0.7 or later, where the off-by-one error in mxml_strtod() has been corrected. For environments unable to update promptly due to dependency constraints, implementing strict input validation is recommended as a compensating control. This includes enforcing locale-independent parsing rules for numeric fields within XML documents, ensuring that only standard ASCII decimal points are accepted regardless of system locale settings. Additionally, deploying runtime protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) can significantly reduce the likelihood of successful exploitation by making memory layout unpredictable and preventing code execution from data regions. Regular security audits focusing on internationalized string processing functions should be conducted to identify similar latent issues in other components that handle numeric conversions across different regional configurations.