VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2019· Updated Aug 5, 2024

CVE-2019-20199

CVE-2019-20199

Description

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen() on a NULL pointer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.3-0.8.6 has a NULL pointer dereference in ezxml_decode, causing a crash when parsing a crafted XML file.

Vulnerability

The affected versions are ezXML 0.8.3 through 0.8.6. The function ezxml_decode in ezxml.c performs incorrect memory handling when parsing a crafted XML file, leading to a NULL pointer dereference. The crash occurs when strlen() is called on a NULL pointer at line 196 of ezxml_0.8.6/ezxml.c [1]. The condition is reachable by providing a malicious XML file as input to any parsing entry point such as ezxml_parse_file, ezxml_parse_fd, or ezxml_parse_str [1].

Exploitation

An attacker can trigger the vulnerability by supplying a specially crafted XML file to an application using the ezXML library. No authentication or special network position is required; the attacker only needs to deliver the file (e.g., via upload, download, or direct input) to be processed by the library. The sample crash file crash_009_SEGV_ezxml_decode_strlen.raw reproduces the issue when parsed with ezxml_parse_file [1]. The call chain starts at ezxml_parse_file → ezxml_parse_fd → ezxml_parse_str → ezxml_decode, where the NULL pointer dereference occurs [1].

Impact

Successful exploitation results in a NULL pointer dereference, causing a segmentation fault (SEGV) as shown by AddressSanitizer output [1]. This leads to a denial of service (DoS) condition — the application crashes and becomes unavailable. The impact is limited to availability; there is no indication of information disclosure or code execution from the available references [1].

Mitigation

As of the publication date (2019-12-31), no fixed version of ezXML has been released to address this issue [1]. Users should consider upgrading to a patched version if one becomes available, or apply input validation to reject malformed XML files before they reach the vulnerable function. There is no known workaround that eliminates the crash without modifying the library source code. The issue is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. ezXML / Bugs / #18 NULL pointer defererence (ezxml_decode)

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.