Executive brief
YAML::Syck is a Perl library used for processing YAML data files. A security flaw in its internal text-processing component allows a specially crafted YAML document to cause the library to read one byte beyond its intended memory buffer. While this is a minor technical error, it could potentially lead to small-scale information disclosure or application instability when processing untrusted data.
Technical details
An out-of-bounds read exists in the bundled libsyck library within YAML::Syck before version 1.47. The functions `newline_len` and `is_newline` in `token.c` dereference a scan pointer without sufficient bounds checking or NUL-terminator verification. When lexing a block scalar at a document boundary, the scanner can read one byte past the heap-allocated lexer buffer. This issue represents an incomplete fix for CVE-2025-11683. An attacker can trigger this by providing a crafted YAML document to the `Load` or `LoadFile` functions. The vulnerability was addressed in version 1.47 by introducing explicit limit parameters to the affected functions.
Affected products
- TODDR YAML::Syck before 1.47
Timeline
- 2026-07-13: patched: Fix committed to repository
- 2026-07-16: disclosed: CVE published to NVD