YAML::Syck prior to version 1.38 for Perl contains a buffer underwrite vulnerability (CWE-124) in its base60 (sexagesimal) parsing implementation. Specifically, in the int#base60 and float#base60 handlers in perl_syck.h, a pointer used to parse colon-separated time values can be decremented past the start of the buffer when processing the leftmost segment, causing an out-of-bounds read. This occurs because the inner loop decrements the pointer until it is less than the start pointer, and then dereferences it without proper bounds checking.

The vulnerability allows an out-of-bounds read which may lead to information disclosure or potentially affect the integrity and availability of applications using the affected YAML::Syck versions. The CVSS score of 7.3 (high) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the vendor's announcements for updates. Avoid processing untrusted YAML data with affected versions until a fix is available.