What is the CVSS score of CVE-2025-11683?

CVE-2025-11683 has a CVSS 3.x base score of 6.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of YAML::Syck are affected by CVE-2025-11683?

Perl applications using YAML::Syck library are vulnerable to information disclosure through out-of-bounds memory reads when processing untrusted YAML input.. A patch is available.

How to fix or mitigate CVE-2025-11683?

Within 24 hours: inventory all systems running Perl applications with YAML::Syck and assess exposure to untrusted YAML inputs (user uploads, external APIs, configuration files). Within 7 days: test YAML-Syck 1.47 in staging environments to validate backward compatibility and begin controlled production rollout. Within 30 days: complete deployment of YAML-Syck 1.47 across all affected systems and conduct regression testing to ensure continued application functionality.

YAML::Syck CVE-2025-11683

HIGH

Buffer Overflow (CWE-119)

2026-07-17

Buffer Overflow Microsoft Red Hat Canonical Suse

6.5

CVSS · NVD

Severity by source

NVD

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via any app accepting untrusted YAML; no auth or config required; one-byte OOB read yields low C and low A, no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Jul 17, 2026 - 04:02 NVD

Source Code Evidence Fetched

Jul 17, 2026 - 02:16 vuln.today

Analysis Generated

Jul 17, 2026 - 02:16 vuln.today

CVE Published

Jul 17, 2026 - 00:47 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Out-of-bounds memory read in YAML::Syck's bundled libsyck C library for Perl exposes any application calling Load() or LoadFile() on untrusted YAML to a one-byte heap over-read. The root flaw (CVE-2025-11683) resided in the libsyck block-scalar lexer's newline scanning logic; the patch issued for that CVE was incomplete, leaving a second lexer path uncovered - subsequently disclosed as CVE-2026-57077. Both are resolved in YAML-Syck 1.47 (released July 13, 2026). No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

YAML::Syck is a Perl YAML module that wraps a bundled copy of the libsyck C library for parsing and emitting YAML documents. The flaw is classified CWE-125 (Out-of-bounds Read) and is located in the libsyck functions newline_len and is_newline, which scan forward through the input buffer looking for newline sequences, including CRLF pairs. During block-scalar lexing at a YAML document boundary (e.g., a '|' or '>' scalar adjacent to a '---' separator), the scan dereferences both the current byte and the immediately following byte to detect CRLF pairs, but performs no NUL-terminator check and no bounds verification against the heap lexer buffer's end. The result is a single byte read past the allocated buffer on the heap. The original CVE-2025-11683 fix addressed one such code path; the residual path - now documented as CVE-2026-57077 - was not covered by that patch. The vulnerable API surface is the default YAML::Syck::Load() and YAML::Syck::LoadFile() functions, which are the standard entry points for virtually all callers of this module.

Affected ProductsAI

YAML::Syck (YAML-Syck) for Perl, all versions before 1.47. The vulnerability resides in the bundled libsyck C library compiled as part of the XS extension and is reachable through the default YAML::Syck::Load() and YAML::Syck::LoadFile() interfaces. JSON::Syck, which shares the same libsyck backend, may also be affected on equivalent code paths. The fixed release is YAML-Syck 1.47, published July 13, 2026, documented at https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes.

RemediationAI

Upgrade to YAML-Syck 1.47 or later using cpanm (run: cpanm YAML::Syck) or the CPAN shell (perl -MCPAN -e 'install YAML::Syck'). Version 1.47 resolves CVE-2026-57077 and three additional memory-safety CVEs in the same bundled libsyck code: CVE-2026-57075 (OOB read in base64 decoder), CVE-2026-57076 (use-after-free of anchor key string), and CVE-2026-13713 (use-after-free/double-free of anchor node). The upstream fix commit is at https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b. If immediate upgrade is not possible, the most effective compensating control is to avoid calling Load() or LoadFile() on any externally supplied or attacker-influenced YAML; applications that process only internally generated or cryptographically signed YAML documents are not exposed to this attack path. No configuration flag or runtime option within YAML::Syck disables the vulnerable block-scalar lexer path while preserving normal YAML parsing.