CVE-2026-5037 mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow
A stack-based buffer overflow in mxml allows local attackers to execute arbitrary code or cause denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5037?
CVE-2026-5037 is a medium-severity memory corruption vulnerability in mxml, published on 29 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.
Which versions are affected by CVE-2026-5037?
How do I fix CVE-2026-5037?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-5037 being exploited?
There is no known exploitation of CVE-2026-5037 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-5037, GHSA-2j9m-mc98-jvp7, OESA-2026-1860, UBUNTU-CVE-2026-5037.