Aller au contenu
en Se connecter
9.1 Critique

CVE-2026-57075 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in…

Description

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any !!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document containing a !!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result.

Produits et versions touchés

Produit Versions touchées Corrigé en
YAML::Syck 1.47 premières → < 1.47 1.47

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de YAML::Syck

Les 7 CVE de YAML::Syck →
CVE-2026-57077 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len 7.7 Élevée CVE-2026-57076 YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key… 7.8 Élevée CVE-2026-13713 YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still… 6.2 Moyenne CVE-2026-5089 YAML::Syck versions before 1.38 for Perl has an out-of-bounds read 7.3 Élevée
Suivre cette CVE