An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and… (CVE-2026-75432)

The yaml-cpp library version 0.9.0 contains a vulnerability that enables a remote attacker to access sensitive information by exploiting issues in the src/scanner.cpp file, particularly within the Scanner::PopIndent() and Scanner::PushIndentTo() methods. This vulnerability is identified as CWE-822, which relates to improper restriction of operations within the bounds of a memory buffer. The CVSS 3.1 score of 5.1 reflects a medium severity with low attack complexity and no required privileges or user interaction. No known exploits are reported in the wild, and no patch or remediation information is provided.

An attacker can remotely obtain sensitive information from systems using yaml-cpp 0.9.0 due to improper handling in specific scanner functions. The impact is limited to confidentiality loss with no reported integrity or availability effects. The attack vector requires local access (AV:L), but no privileges or user interaction are needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to affected components and monitor for updates from the yaml-cpp maintainers.