CVE-Katalog

CVE-2026-112094

A security vulnerability has been detected in…

A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Schweregrad: High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Oct 19, 2026, 8:00:22 AM UTC
Updated: Oct 19, 2026, 8:17:03 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.18% · Oct 27, 2026

Projects and upstream resources

[mxml][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	mxml	`4.0.6-3`	FixedDistribution-reported fixed boundary	[CVE-2026-112094]
Debianforky	mxml	`4.0.6-3`	FixedDistribution-reported fixed boundary	[CVE-2026-112094]

Showing 2 fix observations. All 20 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	mxml	Not reported	Not affectedDistribution reports not affected	[CVE-2026-112094]
Debianbookworm	mxml	`3.3.1-1+deb13u1~deb12u1`	Not affected	[CVE-2026-112094]
Debianforky	mxml	`4.0.6-3`	FixedDistribution-reported fixed boundary	[CVE-2026-112094]
Debiansid	mxml	`4.0.6-3`	FixedDistribution-reported fixed boundary	[CVE-2026-112094]
Debiantrixie	mxml	Not reported	Not affectedDistribution reports not affected	[CVE-2026-112094]
Debiantrixie	mxml	`3.3.1-1+deb13u1`	Not affected	[CVE-2026-112094]
Ubuntu16.04	mxml	`2.7-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu16.04	mxml	`2.9-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu16.04	mxml	`2.9-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu18.04	mxml	`2.10-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu20.04	mxml	`2.12-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu20.04	mxml	`3.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu22.04	mxml	`3.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu22.04	mxml	`3.3-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu24.04	mxml	`3.3.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu24.04	mxml	`3.3.1-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu26.04	mxml	`3.3.1-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu26.04	mxml	`3.3.1-1build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu26.10	mxml	`3.3.1-1build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC
Ubuntu26.10	mxml	`4.0.4-6`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-112094]Oct 28, 2026, 8:17:33 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "mxml",
      "status": "fixed",
      "release": "sid",
      "version": "4.0.6-3"
    },
    {
      "name": "mxml",
      "status": "fixed",
      "release": "forky",
      "version": "4.0.6-3"
    },
    {
      "name": "mxml",
      "status": "not affected",
      "release": "trixie",
      "version": "3.3.1-1+deb13u1"
    },
    {
      "name": "mxml",
      "status": "not affected",
      "release": "bookworm",
      "version": "3.3.1-1+deb13u1~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1151360,
      "name": "mxml",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.0.6-3"
    },
    {
      "bug": 1151360,
      "name": "mxml",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.0.6-3"
    },
    {
      "bug": 1151360,
      "name": "mxml",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": 1151360,
      "name": "mxml",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2.7-1",
        "2.9-0ubuntu1",
        "2.9-0ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    },
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.10-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    },
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.12-2",
        "3.1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    },
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.2-1",
        "3.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    },
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "3.3.1-1",
        "3.3.1-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    },
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "3.3.1-1build2",
        "4.0.4-6"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    },
    {
      "name": "mxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "3.3.1-1build1",
        "3.3.1-1build2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-112094",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-112094",
      "provider_updated_at": "2026-10-28T20:17:33.164185898Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1151360]

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 12 (Bookworm)]

[libmxml1]Unbekannt
Quellpaket: [mxml]
Details (2)
- 3.3.1-1+deb13u1~deb12u1 · amd64 · bookworm
  Nicht betroffen
  nvd · mxml · debian · bookworm
- 3.3.1-1+deb13u1~deb12u1 · arm64 · bookworm
  Nicht betroffen
  nvd · mxml · debian · bookworm
[libmxml-dev]Unbekannt
Quellpaket: [mxml]
Details (2)
- 3.3.1-1+deb13u1~deb12u1 · amd64 · bookworm
  Nicht betroffen
  nvd · mxml · debian · bookworm
- 3.3.1-1+deb13u1~deb12u1 · arm64 · bookworm
  Nicht betroffen
  nvd · mxml · debian · bookworm

Beobachtet: Oct 26, 2026, 8:15:20 AM UTC

Referenzen

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]