CVE-2026-57075 Memory corruption in YAML::Syck
An out-of-bounds read in the YAML::Syck Perl library allows attackers to disclose memory or cause crashes via crafted binary YAML data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57075?
CVE-2026-57075 is a critical memory corruption vulnerability in TODDR YAML::Syck, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec.
The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any !!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path.
Any caller that runs Load or LoadFile on an untrusted document containing a !!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result.
Weakness: CWE-125
Which versions are affected by CVE-2026-57075?
How do I fix CVE-2026-57075?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-57075 being exploited?
There is no known exploitation of CVE-2026-57075 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-57075, AZL-109517, AZL-92913, BELL-CVE-2026-57075, DEBIAN-CVE-2026-57075, GHSA-fwh5-hwhp-qgp4 and 1 more.