CVE-2026-57076

{
  "id": "CVE-2026-57076",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-16T22:17:43.550",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor.\n\nIn the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory."
    },
    {
      "lang": "es",
      "value": "Las versiones de YAML::Syck anteriores a la 1.47 para Perl permiten un uso después de liberación en el heap a través de un nombre de ancla reutilizado como clave de la tabla de anclas en syck_hdlr_add_anchor.\n\nEn la libsyck incluida, un nombre de ancla asignado por syck_strndup se almacena tanto como node  ->  anchor, liberado cuando el nodo es liberado, como clave en la tabla de anclas del analizador. La liberación del nodo libera la clave compartida, y una posterior redefinición del ancla hace que st_delete compare con la clave liberada, por lo que st_strcmp lee memoria del heap liberada. Las anclas son una característica estándar de YAML y no requieren banderas especiales, por lo que esto se alcanza en la ruta de carga (Load) predeterminada.\n\nCualquier llamador que ejecute Load o LoadFile en un documento no confiable que redefine un ancla alcanza la lectura de memoria liberada."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "TODDR",
          "product": "YAML::Syck",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "YAML-Syck",
          "programFiles": [
            "handler.c",
            "syck_.c"
          ],
          "programRoutines": [
            {
              "name": "syck_hdlr_add_anchor"
            },
            {
              "name": "syck_hdlr_remove_anchor"
            }
          ],
          "repo": "https://github.com/toddr/YAML-Syck",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.47",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T13:06:52.760676Z",
          "id": "CVE-2026-57076",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/17/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}