LiveActive security incident?Get immediate response
CVE Record

CVE-2018-20592: In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file.

In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted xml file, as demonstrated by mxmldoc.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Mini-XML v2.12 has a memory safety bug that can crash software processing a malicious XML file. The public record describes denial of service, not data theft or code execution. Risk depends on whether affected mxml parsing is reachable from untrusted files or network-delivered XML.

Executive priority

Treat as a targeted availability risk. Prioritize systems where XML parsing is internet-facing, automated, or business-critical. Lower urgency is reasonable for internal-only tooling with trusted XML input and patchable package management.

Technical view

CVE-2018-20592 is a use-after-free in mxmlAdd in mxml-node.c. The CVE states remote attackers could cause denial of service via crafted XML, demonstrated through mxmldoc. Public sources include crash artifacts, an upstream issue, and Fedora advisories. No CVSS score, CWE, or CISA KEV listing is provided.

Likely exposure

Exposure is most likely in applications or tools embedding Mini-XML v2.12 and parsing attacker-supplied XML. The bundle does not identify broader affected product lines or CPEs beyond Mini-XML/mxml v2.12.

Exploitation context

Public crash proof artifacts exist, but the provided sources do not show active exploitation or KEV status. The documented impact is denial of service from crafted XML, not confirmed remote code execution.

Researcher notes

The useful research path is reachability: determine whether mxmlAdd can be reached through untrusted XML in the deployed application. Evidence supports crash-based denial of service, but the bundle does not support claims of active exploitation or code execution.

Mitigation direction

  • Inventory software and packages that include Mini-XML or mxml v2.12.
  • Apply vendor package updates where Fedora advisories apply.
  • Check upstream Mini-XML guidance for fixed versions or patches.
  • Reduce exposure to untrusted XML where updates are not immediately available.
  • Monitor XML-processing services for repeated crashes or abnormal termination.

Validation and detection

  • Confirm whether Mini-XML v2.12 is installed or bundled.
  • Identify applications that parse externally supplied XML with mxml.
  • Check vendor advisory status for each affected platform.
  • Verify updated packages or upstream fixes are deployed.
  • Review crash logs around XML parsing components.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-20592 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.