Description
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Michael R Sweet Mini-XML
Default version status: unaffected
4.0.0 to ≤ 4.0.6affected
pkg:github/michaelrsweet/mxmlReferences
- https://hackmd.io/@haind-pwn/mxml-strtod-locale-stack-overflow ↗
- https://github.com/michaelrsweet/mxml/blob/v4.0.6/mxml-file.c#L1860-L1887 ↗
- https://github.com/michaelrsweet/mxml/commit/367c7ddd3387f65e867d776216de274bcaa3dae1 ↗
- https://www.vulncheck.com/advisories/mini-xml-4.0.0-through-4.0.6-stack-out-of-bounds-write-via-mxml-strtod ↗
- https://hackmd.io/@haind-pwn/cve-2026-110604-mxml-strtod-locale-stack-overflow ↗