CVE-2006-10003 XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack
An off-by-one heap buffer overflow in the Perl XML::Parser library allows attackers to execute arbitrary code or cause denial of service via deeply nested XML.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-10003?
CVE-2006-10003 is a critical memory corruption vulnerability in TODDR XML::Parser, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.
In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.
The bug can be observed when parsing an XML file with very deep element nesting
Which versions are affected by CVE-2006-10003?
It affects 1 product.
Products include Toddr Xml\.
How do I fix CVE-2006-10003?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2006-10003 being exploited?
There is no known exploitation of CVE-2006-10003 in the wild and no public exploit code.
Other vulnerabilities in TODDR XML::Parser
Sources
Also known as AZL-80196, CLSA-2026-1776940444, CLSA-2026-1777396174, DEBIAN-CVE-2006-10003, DSA-6182-1, GHSA-x2wr-f89p-cqwh and 1 more.