CVE-2026-57075 is an out-of-bounds read vulnerability (CWE-125) in YAML::Syck versions before 1.47 for Perl. The issue arises in the syck_base64dec function of the bundled libsyck library, where a signed char is used as an index into a 256-entry static table (b64_xtable). When the base64 decoder processes !!binary YAML nodes containing bytes with the high bit set (>= 0x80), the signed char sign-extends to a negative value, causing the code to read memory before the table bounds. This vulnerability is reachable via the default Load or LoadFile functions on untrusted YAML documents containing such !!binary scalars. The out-of-bounds read may result in unexpected data being included in the decoded output.

The vulnerability allows an out-of-bounds read when parsing untrusted YAML documents with !!binary scalars containing high-bit bytes. This can lead to disclosure of memory contents adjacent to the lookup table, potentially leaking sensitive information. There is no indication of code execution or denial of service from the provided data. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid loading untrusted YAML documents with vulnerable versions of YAML::Syck. Monitor vendor channels for updates or patches addressing this issue.