CVE-2026-57077: CWE-125 Out-of-bounds Read in TODDR YAML::Syck
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.
AI Analysis
Technical Summary
YAML::Syck versions prior to 1.47 contain an out-of-bounds read vulnerability (CWE-125) due to an unbounded newline scan in the functions newline_len and is_newline within the bundled libsyck library. These functions dereference the scan pointer and the following byte without checking for a NUL-terminator or buffer boundaries. This flaw occurs during block-scalar lexing at document boundaries, causing the scan to read one byte beyond the heap lexer buffer. This vulnerability is a partial regression of CVE-2025-11683, as the previous fix did not cover this lexer path. Any use of Load or LoadFile on untrusted YAML documents with block scalars at document boundaries can trigger this out-of-bounds read.
Potential Impact
The vulnerability allows an out-of-bounds read of memory beyond the allocated buffer during YAML parsing. This can lead to information disclosure or application crashes when processing untrusted YAML documents containing block scalars at document boundaries. No known exploits are reported in the wild at this time.
Mitigation Recommendations
No official patch or fix has been confirmed yet for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, avoid loading untrusted YAML documents with block scalars at document boundaries using YAML::Syck versions before 1.47.
CVE-2026-57077: CWE-125 Out-of-bounds Read in TODDR YAML::Syck
Description
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.
CVSS v3.1
Score 7.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
YAML::Syck versions prior to 1.47 contain an out-of-bounds read vulnerability (CWE-125) due to an unbounded newline scan in the functions newline_len and is_newline within the bundled libsyck library. These functions dereference the scan pointer and the following byte without checking for a NUL-terminator or buffer boundaries. This flaw occurs during block-scalar lexing at document boundaries, causing the scan to read one byte beyond the heap lexer buffer. This vulnerability is a partial regression of CVE-2025-11683, as the previous fix did not cover this lexer path. Any use of Load or LoadFile on untrusted YAML documents with block scalars at document boundaries can trigger this out-of-bounds read.
Potential Impact
The vulnerability allows an out-of-bounds read of memory beyond the allocated buffer during YAML parsing. This can lead to information disclosure or application crashes when processing untrusted YAML documents containing block scalars at document boundaries. No known exploits are reported in the wild at this time.
Mitigation Recommendations
No official patch or fix has been confirmed yet for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, avoid loading untrusted YAML documents with block scalars at document boundaries using YAML::Syck versions before 1.47.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-23T18:02:32.995Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59dfe768715ace439a90e0
Added to database: 07/17/2026, 07:55:19 UTC
Last enriched: 07/17/2026, 08:02:51 UTC
Last updated: 08/30/2026, 22:52:12 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.