The vulnerability is an off‑by‑one heap buffer overflow in the st_serial_stack routine of XML::Parser versions through 2.47 for Perl. When an XML document has very deep element nesting, the parser fails to expand the stack at the point where stackptr equals stacksize‑1, causing a write to the location immediately beyond the allocated buffer. This memory corruption can allow a malicious attacker to overwrite critical data and achieve arbitrary code execution, as identified by CWE‑122 and CWE‑193.

Affected products are provided by the vendor TODDR: XML::Parser for Perl. All versions prior to 2.48, including 2.47, are vulnerable. The issue affects the Perl module implementation of the XML::Parser library.

The CVSS base score is 9.8, indicating a critical severity. The EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the parsing of a malicious XML file with deep nesting, which requires the attacker to supply such a file to the vulnerable parser. Given the high severity but low exploitation likelihood, immediate patching is recommended.