The vulnerability in libfyaml 0.9.6 and earlier involves the function fy_atom_iter_format(), which processes YAML documents. When handling a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. Because the allocated stack memory is not released until the function returns, this causes cumulative stack growth that can exceed the process stack limit, resulting in a segmentation fault (SIGSEGV) and denial of service.

An attacker can cause a denial of service by triggering a stack exhaustion condition that crashes the process due to a segmentation fault. There is no indication of code execution or data corruption beyond process termination.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted YAML documents containing very large literal or folded block scalars with vulnerable versions of libfyaml.