SECUFOCUSNOW
Home›CVE index›CVE-2006-10003
Review reviewCritical

CVE-2006-10003

TODDR XML::Parser, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

CVSS
9.8
EPSS
0.55%
42.8% percentile
CISA KEV
Not listed
Published
2026.03.19
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.55%
Technical severityCVSS 9.8

Vulnerability overview

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

Affected product and versions

Product
TODDR XML::Parser, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
<= 2.47, < 2.48
Fixed versions
2.48

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that TODDR XML::Parser, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-122, CWE-193