CVE-2006-10002

High

Published: 19 March 2026

Published

19 March 2026

Modified

23 March 2026

KEV Added

—

Patch

19 March 2026

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0004 12.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2006-10002 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Toddr Xml\. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 12.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely flaw remediation by upgrading XML::Parser to version 2.46, directly eliminating the heap buffer overflow vulnerability.

SI-10 Information Input Validation partial match

prevent

Mandates validation of XML inputs to detect and reject crafted data that could exceed pre-allocated buffers due to UTF-8 decoding mismatches.

SI-16 Memory Protection partial match

prevent

Implements memory protections like heap randomization and guard pages to mitigate corruption from heap-based buffer overflows.

NVD Description

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded…

characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.

Deeper analysisAI

CVE-2006-10002 is a heap-based buffer overflow vulnerability in XML::Parser versions through 2.45 for Perl. The issue occurs in the parse_stream() function within Expat.xs when using the :utf8 PerlIO layer. Perl's read() operation returns decoded characters, but SvPV() retrieves multi-byte UTF-8 bytes, which can exceed the pre-allocated XML input buffer size. This leads to heap corruption, such as double free or corruption, resulting in crashes. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-176 (Improper Handling of Unicode Encoding), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Remote attackers can exploit this vulnerability without privileges or user interaction by supplying crafted XML input over the network. Successful exploitation triggers heap corruption, causing denial-of-service through application crashes, with no impact on confidentiality or integrity.

Advisories and patches recommend upgrading to XML::Parser version 2.46, which addresses the buffer overflow via a commit in the CPAN authors' GitHub repository (56b0509dfc6b559cd7555ea81ee62e3622069255). Related discussions appear in GitHub issue #64, the release changes on MetaCPAN, RT ticket #19859, and an oss-security mailing list post from March 19, 2026.