CVE-2006-10002
Published: 19 March 2026
Summary
CVE-2006-10002 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Toddr Xml\. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 44.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2006-10002 is a heap-based buffer overflow vulnerability in XML::Parser versions through 2.45 for Perl. The issue occurs in the parse_stream() function within Expat.xs when using the :utf8 PerlIO layer. Perl's read() operation returns decoded characters, but SvPV() retrieves multi-byte UTF-8 bytes, which can exceed the pre-allocated XML input buffer size. This leads to heap corruption, such as double free or corruption, resulting in crashes. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-176 (Improper Handling of Unicode Encoding), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote attackers can exploit this vulnerability without privileges or user interaction by supplying crafted XML input over the network. Successful exploitation triggers heap corruption, causing denial-of-service through application crashes, with no impact on confidentiality or integrity.
Advisories and patches recommend upgrading to XML::Parser version 2.46, which addresses the buffer overflow via a commit in the CPAN authors' GitHub repository (56b0509dfc6b559cd7555ea81ee62e3622069255). Related discussions appear in GitHub issue #64, the release changes on MetaCPAN, RT ticket #19859, and an oss-security mailing list post from March 19, 2026.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2006-7232
Vulnerability details
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded…
more
characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct heap buffer overflow in network-facing XML parser enables remote DoS via crafted input causing application crash (CWE-122).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation by upgrading XML::Parser to version 2.46, directly eliminating the heap buffer overflow vulnerability.
Mandates validation of XML inputs to detect and reject crafted data that could exceed pre-allocated buffers due to UTF-8 decoding mismatches.
Implements memory protections like heap randomization and guard pages to mitigate corruption from heap-based buffer overflows.