How to fix CVE-2025-40908?

Within 24 hours: Identify all systems and applications using YAML-LibYAML for Perl and assess exposure to untrusted YAML input. Within 7 days: Apply vendor patch to upgrade YAML-LibYAML to version 0.903.0 or later across all affected systems; prioritize production environments and systems processing external YAML data. Within 30 days: Complete patch deployment to all remaining systems, conduct application testing to verify functionality, and implement input validation controls for YAML processing.

Is Yaml Libyaml affected by CVE-2025-40908?

CVE-2025-40908 is a critical vulnerability in YAML-LibYAML for Perl that allows attackers to modify existing files on affected systems.

CVE-2025-40908

EUVD-2025-16577 CRITICAL

2025-06-01 9b29abf9-4ab0-4765-b253-1875cd9b441e

9.1

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 14, 2026 - 16:42 vuln.today

EUVD ID Assigned

Mar 14, 2026 - 16:42 euvd

EUVD-2025-16577

Patch Released

Mar 14, 2026 - 16:42 nvd

Patch available

PoC Detected

Jul 02, 2025 - 15:43 vuln.today

Public exploit code

CVE Published

Jun 01, 2025 - 14:15 nvd

CRITICAL 9.1

Description

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Analysis

File modification via 2-args open in YAML-LibYAML before 0.903.0 for Perl. PoC and patch available.

Technical Context

CWE-552 via two-argument open().

Affected Products

['YAML-LibYAML < 0.903.0']

Remediation

Update.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +46

POC: +20

Vendor Status

Ubuntu

Priority: Medium

libyaml-libyaml-perl

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
plucky	not-affected	0.903.0+ds-1
upstream	released	0.903.0+ds-1
oracular	ignored	end of life
jammy	released	0.83+ds-1ubuntu0.22.04.1
noble	released	0.89+ds-1ubuntu0.24.04.1
questing	not-affected	-

USN-7632-1

Debian

libyaml-libyaml-perl

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	0.82+repack-1	-
bookworm	fixed	0.86+ds-1+deb12u1	-
trixie	fixed	0.903.0+ds-1	-
forky, sid	fixed	0.904.0+ds-1	-
(unstable)	fixed	0.903.0+ds-1	-

CVE-2025-40908 vulnerability details – vuln.today

Back

CVE-2025-40908

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

CVE-2025-40908

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

External POC / Exploit Code