VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2019· Updated Aug 5, 2024

CVE-2019-20200

CVE-2019-20200

Description

An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap buffer over-read in ezXML 0.8.3 through 0.8.6 in the ezxml_decode function during XML parsing, leading to potential memory information disclosure.

Vulnerability

In ezXML versions 0.8.3 through 0.8.6, the ezxml_decode function in ezxml.c performs incorrect memory handling when normalizing line endings in a crafted XML file. Specifically, the loop at line 163 checks for \r characters and uses memmove with strlen(s) without accounting for the fact that the string might be at the end of the allocated buffer, leading to a heap-based buffer over-read [1]. This occurs during XML parsing when the parser processes character content.

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted XML file to an application using the affected ezXML library. No authentication or special network position is required beyond the ability to provide the file for parsing [1]. The over-read occurs in the ezxml_decode function called from ezxml_char_content during parsing, which is triggered when the parser encounters crafted line endings.

Impact

Successful exploitation results in a heap buffer over-read, potentially leading to information disclosure of adjacent heap memory contents [1]. The attacker may glean sensitive data from memory, but the vulnerability does not allow code execution or privilege escalation based on the available information.

Mitigation

As of the publication date (2019-12-31), no fixed version has been released [1]. Users should monitor the ezXML project for updates and consider alternatives or manually patch the vulnerable function if possible. The issue is tracked in the ezXML bug tracker [1].

References
  1. ezXML / Bugs / #19 Heap buffer overread (ezxml_decode:163)

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.