CVE-2026-88385

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88385
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88385.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88385
Downstream
Published
2026-09-24T00:00:00Z
Modified
2026-10-08T07:08:58Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88385.json"
}
References

Affected packages

Git / github.com/michaelrsweet/mxml

Affected ranges

Type
GIT
Repo
https://github.com/michaelrsweet/mxml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
83ef80ae3c5413b73f501edb59ee74e31ce399d0
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

v2.*
v2.11
v2.12
v3.*
v3.0
v3.1
v3.3
v3.3.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88385.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "95986487297015660152026896529661778531",
                "140592493159003808518458501892291516564",
                "74046161452989369347299698198682323424",
                "115938837896346095224272220904302994030",
                "140709875011958669348091177549211212106",
                "38498608843569853807302343262529892238"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88385-0ac00b54",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0",
        "target":  {
            "file":  "mxml-file.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "288545331936178998094213741500602430751",
            "length":  12181
        },
        "id":  "CVE-2026-88385-eb0755f4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0",
        "target":  {
            "file":  "mxml-file.c",
            "function":  "mxml_load_data"
        }
    }
]
vanir_signatures_modified 
"2026-10-08T07:08:58Z"