Live › vulnerability › CVE-2026-120455
rapidyaml, a C++ YAML parsing library, has an out-of-bounds write in its annotation handling that a crafted YAML document with consecutive anchors or tags can trigger. The sources say it corrupts stack memory and crashes the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Applications that link rapidyaml 0.16.0 or earlier and parse YAML supplied by someone outside the team are exposed. Programs that only parse trusted, local YAML files are less exposed. The sources do not describe a data-exfiltration path, only memory corruption and a crash.
No product ranges from the sources yet.
CMakeLists.txt, a conanfile, a vcpkg.json, or a vendored copy of the ryml sources.0.16.0 (the sources link release notes; the exact fixed version is unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-120455")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.