Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L P N P N L L 2.0 .0022 11.7 —
AFFECTED Product Versions Fixed Mini-XML 4.0.0 – —
TIMELINE Oct 14 EXPLOIT PUBLISHED — CVE-2026-110604 (Michael R Sweet Mini-XML). Public exploit reference added. Oct 14 Reserved by VulnCheck Oct 14 Published (CNA: VulnCheck)
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
| Date | Event | Detail |
|---|---|---|
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-110604 (Michael R Sweet Mini-XML). Public exploit reference added. |
| October 14, 2026 | Reserved | Reserved by VulnCheck |
| October 14, 2026 | Published | Published (CNA: VulnCheck) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Michael R Sweet | Mini-XML | — | 4.0.0 | — |
Authoritative record: CVE-2026-110604 at cve.org
Vendors: michael r sweet
Weaknesses: CWE-193
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-110604 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
