Skip to main content

YAML::Syck CVE-2026-57075

| EUVDEUVD-2026-45054 CRITICAL
Out-of-bounds Read (CWE-125)
2026-07-16 CPANSec GHSA-fwh5-hwhp-qgp4
Buffer Overflow Information Disclosure Red Hat Suse Yaml Toddr
Critical
Disputed · 9.1 Vendor: CPANSec
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CPANSec) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.5 MEDIUM

Default Load path is unauthenticated and network-reachable (AV:N/AC:L/PR:N/UI:N), but the impact is a small fixed-offset over-read: limited disclosure (C:L) and only possible crash on hardened builds (A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 22, 2026 - 10:02 vuln.today
Analysis Generated
Jul 22, 2026 - 10:02 vuln.today
CVE Published
Jul 16, 2026 - 21:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 16, 2026 - 21:39 cve.org
CRITICAL 9.1

DescriptionCVE.org

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec.

The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any !!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path.

Any caller that runs Load or LoadFile on an untrusted document containing a !!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result.

AnalysisAI

Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feeding a crafted YAML document to Load or LoadFile. The bundled libsyck base64 decoder (syck_base64dec) indexes its 256-entry b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table; because !!binary is a standard tag processed on the default Load path (not gated by $LoadBlessed or $LoadCode), the flaw is reachable without any opt-in. No CISA KEV listing and EPSS is low (0.19%, 8th percentile), so no public weaponized exploit is identified at time of analysis, though the exact trigger strings (e.g. '--- !!binary \x80\x80\x80\x80') are publicly documented in the vendor's CI test suite and the oss-security advisory.

Technical ContextAI

The vulnerability lives in libsyck, the C YAML library bundled inside the YAML::Syck XS module (CPE cpe:2.3:a:toddr:yaml::syck). YAML's !!binary type carries base64-encoded data, and syck_base64dec in emitter.c decodes it by looking each input byte up in a static 256-entry translation table, b64_xtable. The lookup was written as b64_xtable[(int)s[0]]; on platforms where char is signed, an input byte with the high bit set (>= 0x80) becomes a negative int, so the code reads memory before the start of the table - a classic CWE-125 out-of-bounds read caused by using a signed type as an array index. The fix (commit 44c90a1, released in 1.47) simply casts each index to (unsigned char) so all 256 byte values map into the valid 0-255 range. Because the decoded sextets are assembled into the returned scalar, whatever bytes lie before the table can be folded into the value handed back to the Perl caller, turning a memory-safety bug into a potential information leak.

RemediationAI

Upgrade to YAML::Syck 1.47 or later - Vendor-released patch: 1.47 (fix commit 44c90a109ec3215ee7ce747bd11209835e123d8b, https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch); the changelog is at https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes and the advisory at https://seclists.org/oss-sec/2026/q3/159. If you cannot patch immediately, the practical compensating control is to avoid running Load/LoadFile on untrusted YAML, or to pre-scan incoming documents and reject those containing a !!binary tag before parsing (the trade-off is that any legitimate use of binary scalars breaks, and naive string matching can be bypassed by unusual whitespace/aliasing so it is a stopgap, not a guarantee). Since the flaw is not gated by $LoadBlessed or $LoadCode, toggling those options does not mitigate it. Where feasible, isolate the parsing process so a memory over-read cannot expose sensitive adjacent data (e.g., parse in a low-privilege, minimal-secret worker).

More in Yaml

View all
CVE-2023-2251 HIGH POC
7.5 Apr 24

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. Rated high severity (CVSS 7.5), this vulnerability
CVE-2022-28948 HIGH POC
7.5 May 19

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu
CVE-2026-4177 CRITICAL
9.1 Mar 16

A critical heap buffer overflow vulnerability exists in YAML::Syck through version 1.36 for Perl, allowing remote attack
CVE-2026-57076 HIGH
7.8 Jul 16

Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when i
CVE-2026-57077 HIGH
7.7 Jul 16

Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger

CVE-2022-3064 HIGH
7.5 Dec 27

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. Rated high severity (CVSS 7.5)
CVE-2026-5089 HIGH
7.3 May 12

Buffer underflow in YAML::Syck for Perl versions before 1.38 allows remote unauthenticated attackers to trigger out-of-b
CVE-2026-13713 MEDIUM
6.2 Jul 16

YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name,

CVE-2012-1152 MEDIUM
5.0 Sep 09

Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and p

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-57075 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy