CVE-2026-57075

A flaw was found in YAML::Syck. An out-of-bounds read vulnerability exists in the base64 decoder, specifically in the syck_base64dec function. This occurs because the decoder uses a signed character to index a lookup table, allowing specially crafted !!binary YAML nodes with high-bit bytes to cause a read beyond the intended memory region. A remote attacker could exploit this by providing a malicious YAML document, potentially leading to information disclosure.

This Moderate impact flaw in perl-YAML-Syck can lead to information disclosure. The vulnerability arises from an out-of-bounds read in the base64 decoder when processing untrusted YAML documents containing !!binary scalars with high-bit bytes. Exploitation requires an application to parse a specially crafted YAML file, making the impact dependent on the application's handling of untrusted input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.