CVE-2026-57076

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47

Description A heap use-after-free occurs when an anchor name is reused as an anchors-table key in the syck hdlr add anchor() function. In the bundled libsyck, an anchor name allocated by syck strndup is stored as both node->anchor and as the key in the parser's anchors table. When the node is freed, the shared key is also freed. A subsequent anchor redefinition causes st delete to compare against this freed key, leading st strcmp to read freed heap memory. This issue can be triggered by any caller using the Load or LoadFile functions on an untrusted document that redefines an anchor.

Recommendations Update to version 1.47 or later.