CVE-2025-11683: YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure
Published Oct 16, 2025
·Updated
YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure
Affected Software
3 affected components
YAML YAML::Syck<1.36
Perl Perl
Toddr Yaml\<1.36
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YAML::Syck (Perl)to a version that resolves this vulnerability.Fixed in 1.36
Event History
Oct 16, 2025
CVE Published
via MITRE·12:14 AM
Data Sourced
via MITRE·12:14 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Oct 21, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-11683?
CVE-2025-11683 has a medium severity due to potential information disclosure through out-of-bounds reads.
2
What versions of YAML::Syck are affected by CVE-2025-11683?
CVE-2025-11683 affects YAML::Syck versions prior to 1.36.
3
How do I fix CVE-2025-11683?
To fix CVE-2025-11683, update YAML::Syck to version 1.36 or later.
4
What causes the vulnerability in CVE-2025-11683?
CVE-2025-11683 is caused by missing null-terminators in the token.c file, leading to out-of-bounds reading.
5
Can CVE-2025-11683 lead to any security risks?
Yes, CVE-2025-11683 can lead to information disclosure risks by allowing adjacent variables to be read.