Out-of-Bounds Write Vulnerability in rapidyaml by Rapid YAML
CVE-2026-120455

6.9MEDIUM

Key Information:

Vendor

Biojppm

Status
Rapidyaml
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120455?

The rapidyaml product version 0.16.0 is affected by an out-of-bounds write vulnerability in the ParseEngine::_add_annotation() method. This security issue enables attackers to potentially corrupt memory by submitting specially crafted YAML data containing excessive anchors or tags. When the number of anchors or tags exceeds the fixed size of a two-element annotation array, it can lead to stack memory corruption. This may ultimately crash the application and pose a risk to users relying on this parsing library for YAML processing.

Affected Version(s)

rapidyaml 0 <= 0.16.0

References

https://github.com/biojppm/rapidyaml/issues/680
issue-tracking
https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/...
technical-description
https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.