CVE-2026-57077

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47

Description An out-of-bounds read occurs during an unbounded newline scan within the newline len function. In the bundled libsyck, the newline len and is newline functions dereference the scan pointer and the subsequent byte for a "r " pair without performing a bounds check or verifying a NUL-terminator. This allows the scan to run one byte past the heap lexer buffer during block-scalar lexing at a document boundary. The issue is triggered when a caller executes Load or LoadFile on an untrusted document containing a block scalar at a document boundary.

Recommendations Update to version 1.47 or later.