TI-2026-41067 Aliases CVE-2026-57077 GHSA-5wqv-8x52-77q2

Out-of-bounds read in TODDR YAML::Syck

LOW 35CWE-125Published 2026-07-16 · Updated 2026-07-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00188 8th percentileScored 2026-11-07

Fix Partial YAML::Syck (TODDR): 1.47Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TODDR	YAML::Syck	before 1.47	1.47	Patch available	CNA

YAML::Syck VendorTODDR Affected before 1.47 Fixed in 1.47 Patch available CNA

Remediation

Fix · CNA YAML::Syck (TODDR) Fixed in 1.47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-16
TODDR YAML::Syck 1.47
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-41065 Out-of-bounds read in TODDR YAML::SyckPriority MEDIUM 48
- TI-2026-41066 Use after free in TODDR YAML::SyckPriority LOW 35
- TI-2026-11561 Double free in TODDR YAML::SyckPriority LOW 27
Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-57077
2026-10-03 Alias added: GHSA-5wqv-8x52-77q2

References

Patch 1

https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch

Other 2

TI-2026-04444 YAML::Syck versions before 1.38 for Perl has an out-of-bounds read CVSS 3.1HIGH 7.3
TI-2006-06994 Heap-based buffer overflow in TODDR XML::Parser CVSS 3.1CRITICAL 9.8
TI-2006-06993 Heap-based buffer overflow in TODDR XML::Parser CVSS 3.1CRITICAL 9.8
TI-2026-41065 Out-of-bounds read in TODDR YAML::Syck CVSS 3.1CRITICAL 9.1
TI-2026-03625 Heap-based buffer overflow in TODDR YAML::Syck CVSS 3.1CRITICAL 9.1
TI-2026-41066 Use after free in TODDR YAML::Syck CVSS 3.1HIGH 7.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences