VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 16, 2021· Updated Aug 3, 2024

CVE-2021-31347

CVE-2021-31347

Description

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writing outside a memory region created by mmap).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Out-of-bounds write in ezxml_parse_str() in ezXML 0.8.6 can cause a crash when parsing crafted XML files.

Vulnerability

Out-of-bounds write in ezxml_parse_str() in ezXML 0.8.6. The function performs incorrect memory handling while parsing crafted XML files, writing outside a memory region created by mmap. This occurs when EZXML_NOMMAP is not set. Affected version: ezXML 0.8.6. [1]

Exploitation

An attacker can provide a specially crafted XML file to the parser. No authentication required. If the parser uses mmap (default), parsing the crafted file triggers an out-of-bounds write in ezxml_parse_str() at lines 586/587 of ezxml.c. This leads to a crash. [1]

Impact

The out-of-bounds write results in a denial-of-service condition (crash) due to writing past the mmap'ed memory region. No information disclosure or code execution has been reported. [1]

Mitigation

As of the publication date (2021-04-16), no official fix is available. A possible workaround is to define EZXML_NOMMAP to disable memory mapping, which may avoid the issue. The bug report on SourceForge remains open. [1]

References
  1. ezXML / Bugs / #27 Out-of-bounds read/write in ezxml_parse_str() in ezxml.c:586/587

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.