Mini-XML vulnerabilities

CVEs whose affected-version data names the Mini-XML package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110604Low· 3.6PoC

2w ago

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-…

▾ TwilightMichael R Sweet · Mini-XMLEPSS 0.22%via NVD