The vulnerability stem from a use‑after‑free condition in the mxml_load_data function of the mike rsweet mxml library versions 4.0.5 and 4.0.6. An attacker can submit specially crafted XML data that causes the library to free a memory block and later access it through an internal error‑handling path, leading to memory corruption that can result in arbitrary code execution or a denial‑of‑service event. The issue is publicly disclosed and carries a CVSS score of 5.1.

It affects the mxml library distributed by michaelrsweet, specifically the 4.0.5 and 4.0.6 releases. No other vendor or product versions are currently documented as vulnerable.

The CVSS score of 5.1 reflects moderate impact, and the lack of an EPSS score indicates exploitation prevalence is unknown but not necessarily high. The flaw can be triggered from a remote context because an attacker can supply malicious XML data over a network, engaging the use‑after‑free. Although the vulnerability is not included in the CISA KEV list, the presence of a community patch and public disclosure imply that the risk is real and should not be dismissed.