VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 26, 2019· Updated Aug 5, 2024

CVE-2019-20005

CVE-2019-20005

Description

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running strchr() starting with a pointer after a '\0' character (where the processing of a string was finished).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap buffer over-read in ezXML 0.8.3-0.8.6 allows denial of service via crafted XML.

Vulnerability

In ezXML versions 0.8.3 through 0.8.6, the function ezxml_decode mishandles memory when parsing a crafted XML file. Specifically, after copying a string including its null terminator, the subsequent strchr() call operates on a pointer that points beyond the null character, leading to a heap-based buffer over-read [1].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted XML file to be parsed by an application using ezXML. No authentication or special privileges are required; the attack is remote if the application parses XML from untrusted sources. The over-read results in a segmentation fault, as demonstrated by AddressSanitizer reports [1].

Impact

Successful exploitation causes a heap buffer over-read, which typically leads to a crash (denial of service) due to accessing memory beyond the allocated buffer. There is no indication of code execution or information disclosure in the available reference [1].

Mitigation

As of the reference publication [1], no fix is available. Users should avoid parsing untrusted XML files with affected versions of ezXML (0.8.3 through 0.8.6) or consider using alternative XML parsing libraries.

References
  1. ezXML / Bugs / #14 Heap buffer overread (ezxml_decode)

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.