Critical severity9.8NVD Advisory· Published Sep 29, 2022· Updated Jun 17, 2026

CVE-2016-2338

Description

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ruby Lang/Ruby2 versions
cpe:2.3:a:ruby-lang:ruby:2.2.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ruby-lang:ruby:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Ruby/Psych::Emitter start_document functiondescription
ruby-git/ruby-gitllm-fuzzy

Patches

Vulnerability mechanics

References

www.talosintelligence.com/reports/TALOS-2016-0032/nvdExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2020/03/msg00032.htmlnvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20221228-0005/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000