VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2019· Updated Aug 5, 2024

CVE-2019-20198

CVE-2019-20198

Description

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.3-0.8.6 contains a stack overflow in ezxml_ent_ok() via a crafted XML file, leading to denial of service.

Vulnerability

The function ezxml_ent_ok() in ezXML versions 0.8.3 through 0.8.6 mishandles recursion when processing a specially crafted XML file, leading to uncontrolled stack consumption [1].

Exploitation

An attacker can cause a denial of service by supplying a malicious XML file that triggers infinite recursion in ezxml_ent_ok(). When an application parses this file using functions like ezxml_parse_file(), the stack overflows, crashing the application. Minimal conditions: network access to deliver the file or local execution of the file [1].

Impact

Successful exploitation results in a stack overflow and application crash, causing a denial of service. No other impacts (such as code execution or privilege escalation) have been reported [1].

Mitigation

No official patch has been released. Users are advised to avoid parsing untrusted XML files with affected versions (0.8.3-0.8.6) or consider using alternative XML libraries. The vendor has been notified through the issue tracker [1].

References
  1. ezXML / Bugs / #20 Stack overflow (uncontrolled recursion)

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.