CVE-2026-120455

Description

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.

References

• https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L4307-L4351
• https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L5524-L5535
• https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hpp#L249-L260
• https://github.com/biojppm/rapidyaml/issues/680
• https://github.com/biojppm/rapidyaml/releases/tag/v0.16.0