CVE-2006-10003CWE-122CWE-193

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

Critical · published March 19, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.

In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.

The bug can be observed when parsing an XML file with very deep element nesting

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00557 · 45.7th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-193 · Off-by-one Error
Published
2026-03-19T11:08Z
EPSS history
Timeline
  • 19 MAR 11:08Z
    XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack
    cvelistv5