VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 26, 2019· Updated Aug 5, 2024

CVE-2019-20007

CVE-2019-20007

Description

An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.2-0.8.6 has a NULL pointer dereference in ezxml_parse_str due to zero-length reallocation in ezxml_str2utf8, causing a crash when parsing crafted XML.

Vulnerability

The vulnerability resides in the ezxml_str2utf8 function in ezxml.c, within ezXML versions 0.8.2 through 0.8.6. When parsing a specially crafted XML file, the function performs a zero-length reallocation at line 478. This implementation-defined behavior (see MEM04-C [1]) can cause realloc to return a NULL pointer, depending on the compiler and runtime. The calling function ezxml_parse_str at line 481 does not check whether the resulting pointer s is NULL before using it, leading to a NULL pointer dereference and segmentation fault [1].

Exploitation

An attacker needs only to provide a crafted XML file to an application using the vulnerable ezXML library. No authentication, special privileges, or user interaction beyond having the file parsed is required. The crashing XML file triggers the zero-length reallocation, causing ezxml_str2utf8 to return NULL, which is then dereferenced in ezxml_parse_str, as demonstrated in the provided ASAN report [1].

Impact

Successful exploitation results in a denial of service (DoS) through a segmentation fault (crash). The CIA impact is limited to availability; there is no indication of information disclosure or code execution from the available references [1].

Mitigation

As of the available references, no official patch has been released. Users should disable the use of untrusted XML files with ezXML or add a NULL check after the realloc call in ezxml_str2utf8 or before using the s pointer in ezxml_parse_str. The project may be considered low maintenance; consider migrating to a maintained XML parsing library [1].

References
  1. ezXML / Bugs / #13 NULL pointer defererence (ezxml_parse_str)

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.