CVE-2026-120455 in rapidyaml
Summary
by MITRE • 11/02/2026
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The rapidyaml library through version 0.16.0 contains a critical out-of-bounds write vulnerability located within the ParseEngine::_add_annotation() function. This flaw arises from an insufficient validation of input data during the parsing phase, specifically when processing YAML documents that contain excessive or consecutive anchors and tags. The underlying technical defect involves a fixed-size two-element array used to store annotation metadata. When the parser encounters more than two such elements in succession without proper bounds checking, it proceeds to write beyond the allocated memory space for this array. This behavior is particularly dangerous because it results in an out-of-bounds write operation that overwrites adjacent stack memory locations rather than triggering a safe exception or error handling routine.
From a technical perspective, this vulnerability aligns with CWE-787: Out-of-Bounds Write, as the application writes data to a memory location outside the bounds of the intended buffer. The attack vector involves an attacker supplying a maliciously crafted YAML file that includes multiple consecutive anchor definitions or tag declarations. During parsing, the _add_annotation() function fails to verify whether the current index exceeds the array's capacity before performing the write operation. In release builds, where certain debug checks and assertions are typically disabled, this oversight allows the memory corruption to occur silently until it manifests as a crash or potentially exploitable state change. The lack of boundary enforcement means that any input exceeding two consecutive annotations will trigger the overflow condition.
The operational impact of this vulnerability is primarily denial-of-service through application crashes due to stack buffer overflows corrupting critical control data such as return addresses or frame pointers. However, depending on the specific memory layout and compiler optimizations in release builds, an attacker might potentially leverage this out-of-bounds write for arbitrary code execution if they can precisely control the overwritten values. This could allow remote attackers to execute malicious commands within the context of the application processing the YAML input. The severity is heightened by the fact that rapidyaml is often used as a core component in larger systems, meaning an exploit here could serve as a foothold for further attacks against dependent services or applications integrating this library.
Mitigation strategies should focus on immediate patching to versions later than 0.16.0 where this issue has been addressed by implementing proper bounds checking within the _add_annotation() function. Developers must ensure that any array access is preceded by a validation step confirming that the index remains within valid limits. Additionally, integrating static analysis tools and fuzz testing into the development pipeline can help detect similar buffer overflow issues early in the lifecycle. For systems currently running vulnerable versions, implementing strict input sanitization to limit the number of consecutive anchors or tags before parsing may provide temporary relief, though upgrading the library is the only definitive solution. This vulnerability also maps to MITRE ATT&CK technique T1059: Command and Scripting Interpreter if exploited for code execution, highlighting the need for robust defense-in-depth measures including memory protection mechanisms like ASLR and DEP where applicable.