YAML::Syck Out-of-Bounds Read Vulnerability in Newline Handling

A vulnerability allowing an out-of-bounds read has been identified in YAML::Syck versions prior to 1.47 for Perl. This issue arises from an unbounded newline scan in the 'newline_len' function, which is part of the bundled libsyck C library. During block-scalar lexing at a document boundary, the scan pointer can advance one byte beyond the allocated heap buffer, potentially leading to the reading of adjacent memory. This vulnerability is an incomplete fix of CVE-2025-11683, affecting the same lexer path that the earlier fix did not cover. The out-of-bounds read can be triggered by loading an untrusted document that contains a block scalar at the beginning or end of the file.

Impact

Exploitation of this vulnerability causes a one-byte out-of-bounds read, which, while not crashing the application, can be observed through AddressSanitizer as a heap-buffer-overflow read in the 'newline_len' function.

Reproduction

The vulnerability can be reproduced by using the 'YAML::Syck::Load' function to load a YAML document that includes a block scalar at the beginning or end. This can be done by, for example, loading a document that contains a block scalar followed by a document separator.

Remediation

Users are advised to update to YAML::Syck version 1.47 or later, where this vulnerability has been fixed.