VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 11, 2021· Updated Aug 3, 2024

CVE-2021-30485

CVE-2021-30485

Description

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp() on a NULL pointer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.6 has a NULL pointer dereference in ezxml_internal_dtd() when parsing crafted XML, causing a denial of service via strcmp on a NULL pointer.

Vulnerability

In ezXML version 0.8.6, the function ezxml_internal_dtd() performs incorrect memory handling while parsing a crafted XML file, leading to a NULL pointer dereference. The crash occurs when strcmp() is called on a NULL pointer. This issue is documented in the bug tracker [1].

Exploitation

An attacker requires the ability to supply a specially crafted XML file to the ezXML library. No authentication or special privileges are needed; the user or application parsing the XML triggers the vulnerability. The debug output in the reference shows a segmentation fault when running the test program against a crafted sample (CVE-2021-30485-nullptr-000.sample) [1].

Impact

Successful exploitation results in a denial of service via application crash (segmentation fault) due to the NULL pointer dereference. There is no indication of code execution or information disclosure in the available references. The impact is limited to availability [1].

Mitigation

As of the reference update (2021-04-11), the bug is reported as open with no patch or fixed version released. Users should avoid parsing untrusted XML files with ezXML 0.8.6 until a fix is published. No workaround is provided in the available references [1].

References
  1. ezXML / Bugs / #25 Null pointer dereference in ezxml_internal_dtd()

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.