CVE-2026-57075 Details
Description
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any !!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document containing a !!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result.
A vulnerability allowing an out-of-bounds read has been identified in YAML::Syck versions prior to 1.47 for Perl. This issue arises in the base64 decoder of the bundled libsyck, where a signed-char lookup-table index is used to access a 256-entry static table. Any !!binary byte with a value of 0x80 or higher is sign-extended to a negative index, leading to a read before the table. The vulnerability can be triggered by the base64 decoder, which processes the raw bytes of any !!binary node on the default Load path, without the need for special flags. This flaw can be exploited by loading an untrusted document containing a !!binary scalar with a high-bit byte, causing the decoder to read adjacent memory and potentially leak data through the decoded result.
Users can upgrade to YAML::Syck version 1.47 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes | CPANSec | BundleRelease NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/07/17/2 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| YAML::Syck | < 1.47 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | CVE Modified | CVE |
| Jul 16, 2026 | New CVE Received | CPANSec |