CVE-2026-88385

Description

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.

Overview

State: PUBLISHED
Assigner (CNA): mitre
CVSS severity: —
CVSS score: —
CVSS vector: —
Effective score: no score available from CNA, NVD, or AI yet
CWE(s): —
Reserved: 2026-09-10
Published: 2026-09-24 00:00 UTC
Last updated: 2026-09-24 16:21 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88385.json

AI-forensic CVSS estimate

Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.

No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-86274
Assigner: mitre
Published: Sep 24, 2026, 12:00:00 AM
Updated: Sep 24, 2026, 4:21:51 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0000
Vendors: n/a
Products: n/a (n/a)
Aliases: GHSA-2rm3-qp6x-wxfh

ENISA description: Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
n/a	n/a	`n/a` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVE-2026-88385 - NONE Vulnerability - AnonHaven

web:anonhaven.com

CVE Details CVE ID CVE-2026-88385 Published Date Sep 24, 2026 Vendor Mini-XML Severity NONE Impact Minimal impact Source View Advisory

2026-09-25 10:46 UTC
CVE-2026-88385 - Vulnerability Details - OpenCVE

web:app.opencve.io

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

2026-09-25 10:46 UTC
CVE-2026-88385 | Memory Leak in Mini-XML XML Parsing

web:basefortify.eu

Vulnerability report for CVE-2026-88385 , including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.

2026-09-25 10:46 UTC
CVE-2026-88385 - Mini-XML Memory Leak Denial of Service

web:cvefeed.io

The following list is the news that have been mention CVE-2026-88385 vulnerability anywhere in the article. Results are limited to the first 20 news articles due to potential performance issues. The following table lists the changes that have been made to the CVE-2026-88385 vulnerability over time.

2026-09-25 10:46 UTC
CVE-2026-88385: Denial of Service | CVETodo

web:cvetodo.com

CVE-2026-88385 is a Denial of Service vulnerability. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-25 10:46 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-09-25 10:46 UTC
CVE-2026-88385 | Ubuntu

web:ubuntu.com

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

2026-09-25 10:46 UTC
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary ...

web:www.cisecurity.org

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete ...

2026-09-25 10:46 UTC
CVE-2026-88385 | Tenable®

web:www.tenable.com

Details Source: Mitre, NVD Published: 2026 -09-24 Updated: 2026 -09-24

2026-09-25 10:46 UTC
CVE-2026-8838 PoC Available, Exploit Status & Vulnerability Details ...

web:www.thehackerwire.com

How do I fix or mitigate CVE - 2026 -8838? To protect against CVE - 2026 -8838, you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-09-25 10:46 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-88385.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T16:21:51.598Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/michaelrsweet/mxml/issues/356"
        },
        {
          "url": "https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-88385",
    "datePublished": "2026-09-24T00:00:00.000Z",
    "dateReserved": "2026-09-10T00:00:00.000Z",
    "dateUpdated": "2026-09-24T16:21:51.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}