Vulnary
← back to the feed
Critical· 9.1

CVE-2026-57075

CVE-2026-57075 affects YAML::Syck versions prior to 1.47 for Perl. The base64 decoder uses a signed char to index a lookup table, allowing an out-of-bounds read when processing !!binary scalars containing bytes with the high bit set. An attacker who can supply untrusted YAML input may cause the decoder to read memory outside the table, potentially leaking data.

publishedJul 17, 2026
last modifiedJul 17, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
30th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 1, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

YAML::Syck versions before 1.47 for Perl

02

Real-world impact

Potential disclosure of memory contents via crafted YAML input.

03

Why this severity

CVSS base score 9.1 (Critical) due to network attack vector, low complexity, no privileges or user interaction required, high confidentiality and availability impacts.

04

What to do about it

no official fix yet
recommended steps
  1. 01No official fix is mentioned in the provided sources.
interim mitigations
  • Avoid loading untrusted YAML documents with !!binary scalars.
  • Upgrade YAML::Syck to version 1.47 or later if available.

Remediation steps are derived solely from the provided data; no vendor patch is referenced.

05

Timeline

06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactNone
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →