The vulnerability is an off‑by‑one stack out‑of‑bounds write in the mxml_strtod() function of Mini‑XML 4.0.0‑4.0.6. When the locale decimal point differs from the default '.', attackers can craft an XML document containing a 63‑digit REAL value followed by a literal ‘.’. This causes the routine to write a NUL byte just beyond its 64‑byte stack buffer, corrupting adjacent stack data or triggering a crash. The vulnerability falls under CWE‑193: Off‑By‑One Error.

Affected products are the Mini‑XML libraries released by Michael R Sweet, specifically versions 4.0.0 through 4.0.6. No other versions are listed as vulnerable, and the affected CPE string indicates the mini‑xml project across platforms. Users running these versions in environments that allow XML ingestion may be impacted.

The CVSS score of 2.0 indicates low severity. The EPSS score of < 1 % suggests limited exploit likelihood, and the vulnerability is not listed in CISA KEV. Successful exploitation requires providing a specifically crafted XML file that contains a 63‑digit REAL value followed by a literal ‘.’ while the system locale uses a decimal separator other than ‘.’. The resulting write of a NUL byte past the 64‑byte stack buffer can corrupt adjacent stack data or trigger a crash of the parsing process. No evidence of existing or widespread exploits is provided in the CVE data, and the effect is limited to a stack corruption or denial of service.