YAML::Syck versions prior to 1.38 for Perl contain a buffer underwrite vulnerability (CWE-124) in the base60 (sexagesimal) parsing functions int#base60 and float#base60 within perl_syck.h. Specifically, when parsing the leftmost segment of a colon-separated time value, an inner loop decrements a pointer until it reaches before the start of the buffer if no colon is found. This leads to dereferencing memory one byte before the allocated buffer, causing an out-of-bounds read. This vulnerability could potentially lead to undefined behavior or memory disclosure depending on usage context.

The vulnerability causes an out-of-bounds read of memory preceding the allocated buffer during YAML parsing. While no direct exploit in the wild is known, such memory access errors can lead to application crashes or potentially expose sensitive memory contents. No CVSS score is assigned, and no vendor advisory or patch information is currently available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding processing untrusted YAML data with vulnerable versions of YAML::Syck. Monitor official TODDR or YAML::Syck project channels for updates or patches addressing this issue.