Executive brief
YAML::Syck, a Perl library used for processing YAML data, contains a flaw in how it handles binary data. An attacker can provide a specially crafted YAML document that causes the library to read memory outside of its intended boundaries. This could allow an attacker to potentially access sensitive information that was not meant to be exposed.
Technical details
An out-of-bounds read vulnerability exists in the bundled libsyck C library within YAML::Syck. The base64 decoder in syck_base64dec indexes a 256-entry static table (b64_xtable) using a signed char. When processing a !!binary node containing bytes with the high bit set (>= 0x80), the index sign-extends to a negative value, resulting in a read before the table's memory space. This can be triggered via the default Load or LoadFile paths on untrusted input. The leaked memory values can surface in the resulting decoded output. The issue is fixed in version 1.47 by casting the index to an unsigned char.
Affected products
- TODDR (CPAN) YAML::Syck versions before 1.47
Timeline
- 2026-07-13: patched: Fix committed to repository
- 2026-07-16: advisory: NVD publication date