CVE-2021-31348

Name of the Vulnerable Software and Affected Versions ezXML version 0.8.6

Description The issue is related to the ezxml parse str() function in the ezXML library, which performs incorrect memory handling while parsing crafted XML files, leading to an out-of-bounds read after a certain strcspn failure. This can be exploited by a remote attacker to cause a denial of service using a specially crafted XML file.

Recommendations For ezXML version 0.8.6, consider disabling the ezxml parse str() function as a temporary workaround until a patch is available. Restrict the use of crafted XML files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.