Rapidyaml
Monthly
Out-of-bounds write in rapidyaml (ryml) through 0.16.0 lets an attacker who can supply a YAML document containing consecutive or excessive anchors/tags overflow the parser's fixed two-element annotation array in ParseEngine::_add_annotation(), corrupting stack memory and crashing the host process in release builds. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, with VA:H and VI:L) means unauthenticated attackers at the local vector need only get an application to process the crafted document, and the assessed consequence is high availability impact with limited integrity effect rather than confidentiality loss. No CISA KEV entry exists and no public exploit code is confirmed at time of analysis, though a third-party technical writeup describing the parser annotation overflow is referenced; vuln.today priority is this_month, i.e. a moderate, non-emergency issue.
Out-of-bounds write in rapidyaml (ryml) through 0.16.0 lets an attacker who can supply a YAML document containing consecutive or excessive anchors/tags overflow the parser's fixed two-element annotation array in ParseEngine::_add_annotation(), corrupting stack memory and crashing the host process in release builds. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, with VA:H and VI:L) means unauthenticated attackers at the local vector need only get an application to process the crafted document, and the assessed consequence is high availability impact with limited integrity effect rather than confidentiality loss. No CISA KEV entry exists and no public exploit code is confirmed at time of analysis, though a third-party technical writeup describing the parser annotation overflow is referenced; vuln.today priority is this_month, i.e. a moderate, non-emergency issue.