VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 15, 2021· Updated Aug 3, 2024

CVE-2021-31229

CVE-2021-31229

Description

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte constant.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.6 has an out-of-bounds write in ezxml_internal_dtd() when parsing crafted XML, leading to a crash.

Vulnerability

In ezXML version 0.8.6, the function ezxml_internal_dtd() performs incorrect memory handling while parsing crafted XML files, leading to an out-of-bounds write of a one byte constant. This occurs when EZXML_NOMMAP is not set, as memory mapping is used in ezxml_parse_fd(). The write attempts to write past the mmap'ed memory region used for reading the crafted XML file [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted XML file to an application that uses the ezXML library. No authentication or special privileges are required; the attacker only needs the ability to supply a malicious XML file for parsing. The out-of-bounds write occurs during the parsing process, leading to a crash [1].

Impact

Successful exploitation results in a denial of service (DoS) due to a crash. The out-of-bounds write writes past the mmap'ed memory region, causing the application to terminate. No code execution or information disclosure has been reported [1].

Mitigation

As of the latest update to the bug report (2021-10-25), no fix has been released for this vulnerability. The issue remains open. Users should avoid processing untrusted XML files with ezXML 0.8.6 until a patch is available. No workarounds are documented. This CVE is not listed in the Known Exploited Vulnerabilities (KEV) catalog [1].

References
  1. ezXML / Bugs / #26 Out-of-bounds write in ezxml_internal_dtd()

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.