A heap-based buffer overflow vulnerability in the XML::Parser Perl module poses a high risk of memory corruption and potential code execution for affected applications.

The vulnerability exists within the parse_stream function in Expat.xs, where improper handling of UTF-8 encoded input during PerlIO layer processing leads to a heap-based buffer overflow. This flaw is remotely exploitable by an unauthenticated attacker.

The flaw carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation allows for heap corruption, which typically results in application crashes (denial of service) or potential arbitrary code execution, threatening the integrity and availability of any system relying on this parser for XML processing.

Immediate Action: Update the XML::Parser module to version 2.46 or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Review application error logs for frequent crashes or unexpected termination of processes utilizing the XML::Parser library.

Compensating Controls: Implement strict input validation or use a Web Application Firewall to filter or reject malformed XML payloads before they reach the backend parser.

Public Exploit Available: Unknown.

Given the potential for heap corruption and the high CVSS severity, organizations should prioritize upgrading to version 2.46. While this is a legacy issue, its persistence in environments using outdated Perl modules requires immediate attention to ensure system stability and security.