CVE-2026-57075

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47

Description An out-of-bounds read exists in the base64 decoder of the bundled libsyck. The issue occurs in the syck base64dec() function, where the 256-entry static table b64 xtable is indexed using a signed char. When a !!binary node contains a byte greater than or equal to 0x80, it sign-extends to a negative index, causing the system to read memory before the table. This can be triggered when Load or LoadFile is used on an untrusted document containing a !!binary scalar with a high-bit byte, potentially allowing the read value to appear in the decoded result.

Recommendations Update to version 1.47 or later.