Vulnerabilidades de Michaelrsweet
CVEs publicadas que afetam produtos de Michaelrsweet: 2 registro(s), com severidade, exploração e correções.
CVE-2026-110604
Baixa · 3.6
CWE-193 14/10/2026
Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
CVE-2026-77220
Média · 6.5
CWE-825 21/08/2026
PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.