GHSA-gfxp-f68g-8x78 `libyml::string::yaml_string_extend` is unsound and unmaintained
Unsound memory handling in libyml allows attackers to trigger undefined behavior, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-gfxp-f68g-8x78?
GHSA-gfxp-f68g-8x78 is a memory corruption vulnerability in libyml, published on 11 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
Which versions are affected by GHSA-gfxp-f68g-8x78?
3 open source packages ship an affected version, including libyml.
| Package | Affected | Fixed in |
|---|---|---|
libyml crates.io | From 0.0.0-0 | None |
libyml crates.io | From 0.0.4 to 0.0.5 | None |
libyml crates.io | From 0.0.4 to 0.0.5 | None |
How do I fix GHSA-gfxp-f68g-8x78?
No fix has been published for GHSA-gfxp-f68g-8x78 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-gfxp-f68g-8x78 being exploited?
There is no known exploitation of GHSA-gfxp-f68g-8x78 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0067.