An out-of-bounds read vulnerability in YAML::Syck for Perl could allow unauthorized information disclosure through memory access.

The vulnerability exists in the syck_base64dec function, where a signed character is used to index a 256-entry static table. Specially crafted !!binary YAML nodes with high-bit bytes can trigger a negative index, leading to an out-of-bounds memory read.

With a CVSS score of 9.1, this vulnerability is critical due to the potential for sensitive information exposure. Attackers could potentially leak internal memory contents, which may contain credentials or other private data, posing a severe risk to system confidentiality.

Immediate Action: Upgrade the YAML::Syck package to version 1.47 or later as provided by the vendor.

Proactive Monitoring: Monitor application logs for unusual crashes or abnormal output patterns when processing untrusted YAML input files.

Compensating Controls: Use a Web Application Firewall or input validation filter to block or sanitize incoming YAML payloads containing suspicious !!binary tags until patching is complete.

Public Exploit Available: No (as of July 20, 2026, there is no confirmed public weaponized exploit).

Given the high CVSS score, organizations utilizing YAML::Syck in Perl-based applications must treat this as a priority update. Applying the 1.47 patch is essential to prevent the potential leakage of sensitive memory information during the parsing of malformed YAML data.