VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 16, 2021· Updated Aug 3, 2024

CVE-2021-31348

CVE-2021-31348

Description

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.6 has an out-of-bounds read/write in ezxml_parse_str() when parsing crafted XML, leading to crash or potential information disclosure.

Vulnerability

In ezXML version 0.8.6, the function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files. Specifically, after a strcspn failure, an out-of-bounds read occurs, leading to an out-of-bounds write at lines 586 and 587 of ezxml.c. This issue is triggered when EZXML_NOMMAP is not defined, as memory mapping is used in ezxml_parse_fd() [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted XML file to an application that uses the ezXML library. No authentication or special privileges are required; the attacker only needs the ability to supply the malicious XML input. The out-of-bounds write occurs when the library attempts to write past the mmap'ed memory region used for reading the file, resulting in a crash [1].

Impact

Successful exploitation leads to a denial of service due to a crash. Additionally, the out-of-bounds read may disclose sensitive information from adjacent memory. The vulnerability does not appear to allow remote code execution based on the available information [1].

Mitigation

As of the publication date (2021-04-16), no fix has been released for this vulnerability. The bug report on SourceForge remains open [1]. Users are advised to avoid parsing untrusted XML with ezXML 0.8.6 or consider using an alternative XML parsing library until a patch is available.

References
  1. ezXML / Bugs / #27 Out-of-bounds read/write in ezxml_parse_str() in ezxml.c:586/587

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.