Mini-XML version 4.0.5 has a memory leak in the mxml_load_data() routine when parsing malformed XML. When a malformed document is processed, the library creates text nodes with mxmlNewText(), but those nodes can escape the normal cleanup path if a parse error occurs. The orphaned nodes remain allocated, so each parsing attempt consumes additional memory that is never freed. Over repeated requests from an attacker the system’s available memory can be exhausted, causing a denial of service.

Any system that incorporates Mini-XML 4.0.5 and exposes the mxml_load_data() function to external input is potentially vulnerable. This includes applications or services that process XML content using this library, especially those that send or receive XML data from the internet or other untrusted sources.

Based on the description, it is inferred that an attacker can trigger the leak by delivering specially crafted malformed XML to any component that calls mxml_load_data(). The CVSS score of 6.5 indicates medium severity, and the EPSS score of <1% suggests a low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Although the attack path is straightforward, cumulative memory exhaustion can lead to system-wide denial of service if the vulnerability is repeatedly exercised.