YAML::Syck CVE-2026-5089

Exploitation requires the target application to parse YAML input through YAML::Syck with ImplicitTyping enabled (the default behavior) and process base60/sexagesimal numeric values. The vulnerable code path activates specifically when YAML content contains colon-separated numeric sequences that the parser interprets as timestamps or durations per YAML 1.0 specification (e.g., '1:30:45', '59:59'). Critically, the buffer underflow triggers on the leftmost segment of these values when no colon prefix exists. The vulnerability does NOT require special deployment configurations beyond default YAML::Syck installation. Attack vector is network-accessible (AV:N) if the application accepts YAML from remote sources such as API endpoints, configuration uploads, or data import features. No authentication (PR:N) or user interaction (UI:N) required-automated processing of malicious YAML triggers the flaw. The low attack complexity (AC:L) reflects that crafting triggering input requires only basic understanding of YAML syntax. Limiting factors: exploitation requires the application specifically uses YAML::Syck rather than alternative Perl YAML parsers (YAML::XS, YAML::PP, YAML::Tiny), and the out-of-bounds read is limited to one byte before the buffer, constraining information disclosure scope and making reliable exploitation platform-dependent based on heap layout.

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, low-complexity exploitation without authentication, suggesting easy remote exploitation. However, multiple factors reduce practical risk: EPSS score of 0.01% (3rd percentile) indicates extremely low predicted exploitation probability based on historical data patterns. No CISA KEV listing confirms absence of observed active exploitation. The impact is limited to out-of-bounds read (not write), restricting attack outcomes to information disclosure of adjacent memory and potential denial-of-service through crashes rather than arbitrary code execution. The CVSS impact ratings (C:L/I:L/A:L) align with this assessment, though the Integrity impact may be overstated since buffer underflows typically don't enable direct data modification. Attack complexity is genuinely low-any application parsing untrusted YAML through YAML::Syck becomes vulnerable. The patch is straightforward (changes 'colon >= ptr' to 'colon > ptr' and adds boundary checks), suggesting the vendor assessed this as a significant but not critical security issue. Priority should focus on Perl applications that parse external YAML input, particularly web services and data processing pipelines. Applications parsing only trusted/internal YAML files face minimal risk.

An attacker hosts a malicious YAML document or injects crafted YAML content into a system using YAML::Syck for parsing. The payload contains a base60 value without colons in the leftmost segment (e.g., 'timestamp: 42' where implicit typing treats it as sexagesimal). When the parser processes this value through the int#base60 or float#base60 handler, the colon pointer decrements past the buffer start, reading one byte before allocated memory. The attacker could leverage this to extract sensitive data from adjacent heap memory regions or cause application crashes through invalid memory access, particularly in tight loops processing multiple YAML documents. Public proof-of-concept exists via the vendor's test case in t/gh-132-base60-safety.t demonstrating the vulnerable code path.