CVE-2026-57075
CVE-2026-57075 affects YAML::Syck versions prior to 1.47 for Perl. The base64 decoder uses a signed char to index a lookup table, allowing an out-of-bounds read when processing !!binary scalars containing bytes with the high bit set. An attacker who can supply untrusted YAML input may cause the decoder to read memory outside the table, potentially leaking data.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
YAML::Syck versions before 1.47 for Perl
Real-world impact
Potential disclosure of memory contents via crafted YAML input.
Why this severity
CVSS base score 9.1 (Critical) due to network attack vector, low complexity, no privileges or user interaction required, high confidentiality and availability impacts.
What to do about it
- 01No official fix is mentioned in the provided sources.
- ›Avoid loading untrusted YAML documents with !!binary scalars.
- ›Upgrade YAML::Syck to version 1.47 or later if available.
Remediation steps are derived solely from the provided data; no vendor patch is referenced.