CVE-2021-42260

What it actually does

The flaw triggers an infinite loop inside TiXmlParsingData::Stamp when processing a crafted UTF-8 lead byte sequence (TIXML_UTF_LEAD_0), consuming CPU until the process is terminated or the system is exhausted.

Why it matters to the business

Services that accept untrusted XML input can be forced offline, causing outages, delayed processing, and potential loss of availability for dependent applications and users.

How an attack unfolds

An attacker crafts a minimal XML document containing the triggering byte sequence and sends it to any application that parses XML with the vulnerable TinyXML library; the parser enters the loop and never returns, resulting in denial of service.

How to fix it

Replace TinyXML with a maintained fork or alternative XML parser; if an upstream fix exists beyond version 2.6.2, upgrade all affected packages; otherwise apply strict input sanitization or size limits before parsing.

How to confirm the fix worked

Attempt to parse the known triggering XML snippet in a controlled environment and confirm the parser returns or times out instead of looping; re-test after any library update or wrapper change.

Typical attack path

1. Identify an endpoint or service that ingests XML using TinyXML
2. Craft a minimal XML payload containing the TIXML_UTF_LEAD_0 byte pattern
3. Transmit the payload over the network or via local file upload
4. Observe sustained high CPU usage or process hang confirming the loop

How to detect it

Review application and system logs for processes that become unresponsive while handling XML; correlate with sudden CPU saturation on services known to use TinyXML; inspect any available stack traces pointing to TiXmlParsingData::Stamp.

What your security team should do

• Inventory all software that statically or dynamically links TinyXML
• Prioritize replacement or upgrade on any internet-facing or multi-tenant systems
• Add XML schema validation and size limits in front of the parser as a temporary control
• Monitor for anomalous CPU spikes on hosts running affected parsers