CVE-2026-112094
Description
A flaw was found in mxml. A remote attacker can exploit a use-after-free vulnerability by supplying specially crafted XML input processed by the mxml_load_data function. This flaw can lead to memory corruption, causing a Denial of Service (DoS) through an application crash or potentially allowing arbitrary code execution.
Statement
Red Hat rates this flaw as Important because an unauthenticated remote attacker could cause memory corruption, leading to application crashes or potential arbitrary code execution. Exploitation requires an application using the Mini-XML library to process untrusted XML input, running under the permissions of the vulnerable process. However, supported enterprise releases maintain older major versions that do not include the vulnerable logic introduced in newer upstream versions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to safely clean up newly added sibling nodes in mxml_load_data error handling rather than calling recursive mxmlDelete across ancestor and descendant nodes: upgrade to the fixed release, which introduce mxml_delete_loaded to safely clean up only newly added sibling nodes without re-deleting caller-owned top nodes or already-freed subtrees, closing all 2 injection vectors (malformed XML documents with multiple root tags, crafted XML triggering parser error handling). Until patched, this is a concern on applications accepting untrusted XML documents parsed using mxml_load_data or wrapper functions across any platform, so restrict ingestion of untrusted XML payloads processed by mxml_load_data or enforce pre-parsing validation to prevent processing of malformed XML structures. As a compensating measure, enable address space layout randomization to impede reliable prediction of code and data pointers via dangling heap nodes, utilize glibc heap allocator safe-linking and metadata protection to detect or obstruct heap metadata corruption, and configure service watchdog monitoring and automatic restart to bound denial-of-service downtime from application crashes. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap use-after-free defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
