rapidyaml Out-of-Bounds Write in ParseEngine::_add_annotation()
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
rapidyaml through 0.16.0 contains an out-of-bounds write in ParseEngine::_add_annotation(). A local user with low privileges, or a user who processes attacker-supplied YAML, can trigger it by supplying YAML with consecutive anchors or tags, which overflows a fixed two-element array in release builds. The out-of-bounds write (CWE-787) corrupts stack memory and crashes the process.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
The sources list no fixed version for rapidyaml.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Timeline
- 2026-11-02 Threatist record created from CVE-2026-120455
- 2026-11-02 Alias added: GHSA-pj6m-mgp5-m3qx
- 2026-11-04 Priority changed: MEDIUM → LOW
References
Other 6
- https://github.com/biojppm/rapidyaml/issues/680
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L4307-L4351
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L5524-L5535
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hpp#L249-L260
- rapidyaml v0.16.0 Release Notes
- https://hackmd.io/@haindpwn/rapidyaml-parser-annotation-oob-write
Sources
- CVE-2026-120455 · CVE Program
- CVE-2026-120455 · NVD
- FIRST EPSS
- GHSA-pj6m-mgp5-m3qx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences