The vulnerability CVE-2026-19614 affects CyberELF NanoXML version 2.2.3 due to improper restriction of XML external entity references (CWE-611). The XML parser's default configuration enables external entity processing, which can be exploited via XXE injection attacks. This flaw allows attackers with at least low privileges (PR:L) and network access (AV:N) to potentially manipulate XML input to cause unintended behavior. The CVSS 4.0 base score is 5.3, reflecting medium severity with low attack complexity and no user interaction required. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed by the vendor.

The vulnerability allows an attacker to leverage XML external entity injection to potentially access unauthorized data or disrupt application processing. The impact is limited by the requirement of low privileges and network access, and no user interaction is needed. The medium CVSS score indicates moderate risk, but no active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling XML external entity processing in NanoXML if possible or apply any recommended configuration changes to mitigate XXE risks.