A stack‑based buffer overflow is triggered by a maliciously crafted value for the argument named "tempr" in the function index_sort within mxml-index.c of the mxml library. The flaw allows a local attacker to corrupt the stack, potentially causing a program crash or enabling local privilege escalation. The vulnerability is listed as CWE‑119 and CWE‑121, indicating a classic buffer overflow weakness. Because the flaw is confined to local execution, only an attacker able to run code on the affected system can exploit it, yet the impact could be severe if the process runs with elevated privileges.

The mxml library, version 4.0.4 and earlier, is affected. The vulnerability resides in the mxmlIndexNew component. No additional vendor or product information is supplied, and patch status is identified by commit 6e27354466092a1ac65601e01ce6708710bb9fa5.

The CVSS base score is 4.8, reflecting a Moderate severity with an Access Vector limited to local. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must have local system access to execute the exploit, but the flaw has been publicly disclosed and demonstrated, raising the risk of exploitation in environments where mxml is deployed without an updated version.