MEDIUM 6.9 NVD
CVE-2026-120455
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YA
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
References
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L4307-L4
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L5524-L5
- https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hpp#L249-L260
- https://github.com/biojppm/rapidyaml/issues/680
- https://github.com/biojppm/rapidyaml/releases/tag/v0.16.0
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-02 via NVD.
vulnfeed aggregates 17991 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.