Medium severity6.1NVD Advisory· Published Nov 2, 2026
CVE-2026-120455
CVE-2026-120455
Description
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
7- github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hppnvd
- github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hppnvd
- github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hppnvd
- github.com/biojppm/rapidyaml/issues/680nvd
- github.com/biojppm/rapidyaml/releases/tag/v0.16.0nvd
- hackmd.io/@haindpwn/rapidyaml-parser-annotation-oob-writenvd
- www.vulncheck.com/advisories/rapidyaml-through-0.16.0-out-of-bounds-write-via-parseengine-add-annotationnvd
News mentions
0No linked articles in our index yet.