CVE-2026-120455
mediumrapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying Y…
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L4307-L4... disclosure@vulncheck.com
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L5524-L5... disclosure@vulncheck.com
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hpp#L249-L260 disclosure@vulncheck.com
- https://github.com/biojppm/rapidyaml/issues/680 disclosure@vulncheck.com
- https://github.com/biojppm/rapidyaml/releases/tag/v0.16.0 disclosure@vulncheck.com
- https://hackmd.io/@haindpwn/rapidyaml-parser-annotation-oob-write disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/rapidyaml-through-0.16.0-out-of-bounds-write-via-pars... disclosure@vulncheck.com