Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-5089

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CPANSec

Description

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer: while ( colon >= ptr && *colon != ':' ) { colon--; } if ( *colon == ':' ) *colon = '\0'; // colon may be ptr-1 here When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TODDR YAML::Syck

Default version status: unaffected

  • 0 to < 1.38affected

References