CVE-2006-10002: XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes

Security readout for executives and security teams

XML::Parser for Perl through version 2.45 can mishandle UTF-8 stream input and corrupt memory. In practical terms, software that parses untrusted XML with this library may crash and, per the CVSS rating, could face broader compromise risk. No provided source shows active exploitation. Exposure is most likely in Perl applications or services using XML::Parser version 2.45 or earlier to process XML streams, especially untrusted input with UTF-8 PerlIO handling. Systems using OS-packaged Perl modules should verify their distribution’s package version and backport status. Treat as urgent for internet-facing or partner-facing systems that parse XML using Perl XML::Parser. Patch validation should be prioritized, but response messaging should avoid claims of active exploitation unless new evidence appears. Mitigation focus: Upgrade XML::Parser to version 2.46 or a vendor package containing the referenced patch.; Check operating system or Perl distribution advisories for backported fixes.; Reduce exposure of XML parsing endpoints that accept untrusted input until patched..

Prepared

Apr 30, 2026, 01:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.