EUVD-2026-12523Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft YAML with oversized class name
-
ExploitTrigger heap buffer overflow in emitter
-
ImpactLeak sensitive memory or crash application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | YAML::Syck Perl module versions ≤1.36 processing untrusted YAML input with class names exceeding 512 bytes. No authentication required; remote exploitation via network-accessible YAML parsing. |
| Impact | The CVSS 3.1 score of 9.1 reflects the severity accurately given the network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), with high impacts to both confidentiality and availability. The vulnerability allows remote code execution through crafted YAML input, making it particularly dangerous for web applications or services processing user-supplied YAML. While no EPSS score or KEV listing is mentioned in the provided data, the existence of patches and detailed technical analysis suggests this is a well-understood vulnerability. The combination of remote exploitability, no authentication requirements, and potential for code execution makes this a critical priority for patching. |
| Exploit ScenarioDerived | An attacker could craft a malicious YAML document with an excessively long class name (over 512 bytes) and send it to a vulnerable application's YAML parsing endpoint, triggering a heap buffer overflow that could lead to arbitrary code execution on the server. Given the network attack vector and low complexity, this could be automated to scan for and exploit vulnerable services at scale. The lack of authentication requirements means any exposed YAML parsing functionality becomes a potential entry point for compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attackers to potentially execute arbitrary code or cause denial of service without authentication. The vulnerability stems from multiple memory corruption issues including heap overflow when processing YAML class names exceeding 512 bytes, buffer overread in base64 decoding, and memory leaks. With a CVSS score of 9.1 and network-based attack vector requiring no user interaction, this presents a severe risk to applications parsing untrusted YAML input.
RemediationAI
Upgrade YAML::Syck to version 1.37_01 or later immediately, which includes the patch available at https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch. If immediate patching is not possible, implement strict input validation on all YAML data before processing, limit the size of YAML documents accepted, and consider running YAML processing in isolated environments with restricted permissions. Applications should also audit their use of YAML::Syck to identify all instances where untrusted input might be processed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YAML::Syck is a Perl module providing a fast YAML 1.0 loader and dumper based on the libyaml library. The vulnerability manifests as a heap buffer overflow (CWE-122) in the YAML emitter component when processing class names that exceed the initially allocated 512-byte buffer. Additional memory safety issues include the base64 decoder reading past buffer boundaries on trailing newlines, strtok mutations corrupting shared node data structures, and memory leaks in anchor handling. These flaws affect the core parsing and emission logic used when processing YAML documents, making any Perl application using YAML::Syck vulnerable when handling untrusted input.
Know when Yaml gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
DescriptionCVE.org
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.
The heap overflow occurs when class names exceed the initial 512-byte allocation.
The base64 decoder could read past the buffer end on trailing newlines.
strtok mutated n->type_id in place, corrupting shared node data.
A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
Executive ViewAI
CVE-2026-4177 presents critical security risk, a heap-based buffer overflow vulnerability rated CVSS 9.1. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Rated high severity (CVSS 7.5), this vulnerability
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu
Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feed
Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when i
Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. Rated high severity (CVSS 7.5)
Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-b
Out-of-bounds memory read in YAML::Syck's bundled libsyck C library for Perl exposes any application calling Load() or L
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name,
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and p
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB