Hi,

The following vulnerability was published for mxml.

CVE-2026-110604[0]:
| Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-
| bounds write in mxml_strtod() when the locale decimal point is not
| '.'. Attackers can supply XML with a 63-digit REAL value followed by
| '.' to write a NUL byte past the 64-byte stack buffer, corrupting
| stack memory or crashing the process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110604
https://www.cve.org/CVERecord?id=CVE-2026-110604
[1] https://github.com/michaelrsweet/mxml/commit/367c7ddd3387f65e867d776216de274bcaa3dae1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
mxml, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151361@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alastair McKinstry <mckinstry@debian.org> (supplier of updated mxml package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 21 Oct 2026 13:12:09 +0100
Source: mxml
Architecture: source
Version: 4.0.6-3
Distribution: unstable
Urgency: medium
Maintainer: Alastair McKinstry <mckinstry@debian.org>
Changed-By: Alastair McKinstry <mckinstry@debian.org>
Closes: 1151360 1151361
Changes:
 mxml (4.0.6-3) unstable; urgency=medium
 .
   * Patch from suywang (github) for CVE-2026-112094. Closes: #1151360
   * Upstream patch for CVE-2026-110604. Closes: #1151361
Checksums-Sha1:
 461999a1890bf37ce225c49738b2490198707b11 1864 mxml_4.0.6-3.dsc
 8899ad4c0fee28a3e175023c7f5863ce6890f0e7 15012 mxml_4.0.6-3.debian.tar.xz
 18ddb0ceceb9e5705c02487210b2929c95ecec7f 5885 mxml_4.0.6-3_arm64.buildinfo
Checksums-Sha256:
 6ade4934fe820f3efaac096da15b72955e7c7ad8dfa4a1a6434d70ffce6f70bd 1864 mxml_4.0.6-3.dsc
 13f9eed1122b08a240aa1f5878b5683515a9ab38bd55fa3919f84cf2ec50040e 15012 mxml_4.0.6-3.debian.tar.xz
 74cf1afad5b1f008155f0146d9b643da5c19911aba566a11508364e827f1f023 5885 mxml_4.0.6-3_arm64.buildinfo
Files:
 223cc09f1ed67e2151ce4e102695c840 1864 libs optional mxml_4.0.6-3.dsc
 bb4f04ad95d0fe76b0fd5f929e8e6707 15012 libs optional mxml_4.0.6-3.debian.tar.xz
 b08c45892fa4ff6f91893d3206ec03ad 5885 libs optional mxml_4.0.6-3_arm64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgjg86RZbNHx4cIGiy+a7Tl2a06UFAmrYrPIACgkQy+a7Tl2a
06WsohAAiZYwI2r9Ult7G34nwS623v251dK08bISYapyoSg6RJxZ3nW97vbjQJRB
mEXmMSXH3+BHFAF5ifqQNCBfj9x13CTGtJRb6LrnG6VdxJQJ1Rr9/pZkS0K33rZl
sov5skslPkkMSf2Crk9XGPOL1yBv+r77SLKFHY9d0PetvONXCD3TDg0uYpSfnnQD
bwY2FnofMsLudH9lFhxtRVIGYW5iftx29LqwcX2DoWh19iPAFtOQVSKWycGuQQAD
FICqy5JwmT2vevSm1D9JW964RyUlpJyL7aiHViDK/Wc+lYueIYyfFZzYaFbfL2KR
ZItuhcKvvmFSMLvxV+sqdnMBoWKRD0iY15exb5T7t3f0W5BNbrUIPdZZdX+MnXCo
N81qBRAnGcf1awgdPQDQ4pxGP+Pfdvr/95yTq3ZA6HIFtqimMEDSD6IOElr65q76
QZV2iE/RFyOkX7ngKJy4EodJegcEBUU+pw4aTjr80F7WRkwWuPNJez3LCTGCFz4J
AR5WSkB21qVR9FOZkalMljiDI9AJrDFb3DnPO0XtNQGcy7xbQ8chkZSce9a4wOj1
iY5pYeS9xnlSp6rybQZFcUSPN3k/a6kXjK2VALerxApogq+OLTuPqW2tTrtwZR/R
MtB55omcfZF/cxcLlL7OgeNTDi3dFj2H5j0tNMbhORWdpVVJxow=
=3QZW
-----END PGP SIGNATURE-----