Critical Out-of-Bounds Flaw in Perl Syck

Security researchers have identified a critical vulnerability within YAML::Syck, a component commonly utilized for processing data in Perl. The flaw stems from a technical oversight in how the library handles specific binary data, exposing a path for unauthorized memory access during standard parsing operations.

Memory Access via Signed Chars

The issue resides within the base64 decoder contained in the bundled libsyck component. Specifically, the decoder utilizes a 256-entry static table known as b64_xtable. When processing input, the system indexes this table using a signed character.

Because the index is signed, any byte valued at 0x80 or greater within a !!binary node triggers a sign-extension. This results in a negative index, causing the application to perform an out-of-bounds read before the table's defined memory range. This behavior occurs on the default Load path, as !!binary nodes are not restricted by existing controls like $LoadBlessed or $LoadCode.

Triggering the Vulnerability

The vulnerability, tracked as CVE-2026-57075, can be invoked by any application that executes Load or LoadFile on an untrusted YAML document. If that document contains a !!binary scalar featuring a high-bit byte, the library will trigger the out-of-bounds read.

• Advisory Identifier: GHSA-fwh5-hwhp-qgp4
• Affected Versions: Before 1.47
• CVSS Severity Score: 9.1

The data obtained through this out-of-bounds read can subsequently surface within the decoded result of the YAML document. This directly exposes memory contents that were not intended to be accessed or returned by the parsing process.

Implications for Data Handling

For developers and system administrators, this vulnerability signifies a need to assess how Perl environments interact with YAML data. Because the flaw is reached during standard processing, any service that accepts or parses input from untrusted sources is affected by the underlying behavior of the libsyck decoder. Organizations managing infrastructure that relies on this specific version of the library must address the identified out-of-bounds read to prevent unintended memory exposure.