CVE-2026-110604
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Att
CVSS
3.6
Low
EPSS
0.2%
p12
KEV
—
Exploit Today
4
0-100
Published: Oct 14, 2026 · Last modified: Oct 14, 2026 · CWE-193
0.2%EPSS · 30 days0.2%
2026-10-152026-10-19
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
- github.comhttps://github.com/michaelrsweet/mxml/blob/v4.0.6/mxml-file.c#L1860-L1887
- github.comhttps://github.com/michaelrsweet/mxml/commit/367c7ddd3387f65e867d776216de274bcaa3dae1
- hackmd.iohttps://hackmd.io/@haind-pwn/mxml-strtod-locale-stack-overflow
- www.vulncheck.comhttps://www.vulncheck.com/advisories/mini-xml-4.0.0-through-4.0.6-stack-out-of-bounds-write-via-mxml-strtod
- hackmd.iohttps://hackmd.io/@haind-pwn/cve-2026-110604-mxml-strtod-locale-stack-overflow
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-127274.3 MED—
——0IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.18hCVE-2026-1112736.1 MED3.2%
——1unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.4dCVE-2026-1084438.8 HIG37.0%
——11Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.18hCVE-2026-1013026.5 MED33.9%
——10TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic.
A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).15hCVE-2026-977418.8 HIG55.2%
——17Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.5dCVE-2026-1028578.8 HIG55.2%
——17Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.5d