An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmlinternaldtd() performs incorrect memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte constant.