CVE-2025-11683 Information disclosure in YAML::Syck
Attackers can read adjacent memory via out-of-bounds read in YAML::Syck when processing complex YAML files, potentially disclosing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11683?
CVE-2025-11683 is a medium-severity vulnerability in TODDR YAML::Syck, published on 16 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure
Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read
The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
Weakness: CWE-119
Which versions are affected by CVE-2025-11683?
It affects 1 product.
Linux distribution packages (1)
perl-YAML-Syck openSUSE:Tumbleweed | All versions | 1.450.0-1.1 |
Products include Toddr Yaml\.
How do I fix CVE-2025-11683?
Upgrade to a fixed version.
Is CVE-2025-11683 being exploited?
There is no known exploitation of CVE-2025-11683 in the wild and no public exploit code.
Other vulnerabilities in TODDR YAML::Syck
Sources
Also known as AZL-109466, AZL-109514, BELL-CVE-2025-11683, DEBIAN-CVE-2025-11683, GHSA-gr2g-vmxj-5cv8, UBUNTU-CVE-2025-11683 and 2 more.