CVE-2023-34194

HIGH 7.5CVE-2023-34194 · Published 13/12/2023 · updated 17/06/2026

In short

CVE-2023-34194 is a HIGH (CVSS 7.5) vulnerability affecting tinyxml (tinyxml project).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
tinyxml tinyxml_project	`≤ 2.6.2`	No fix yet

Description

StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.

References

lists.debian.org/debian-lts-announce/2023/12/msg00024.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6
sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp · Patch
forescout.com/resources/sierra21-vulnerabilities · Third Party Advisory
lists.fedoraproject.org/archives/list/[email protected]/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE
lists.fedoraproject.org/archives/list/[email protected]/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6

More vulnerabilities in tinyxml

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free