UBUNTU-CVE-2026-120455: Medium severity ubuntu/rapidyaml vulnerability
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::addannotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use rapidyaml to parse attacker-controlled YAML are exposed, particularly where an attacker can submit documents containing consecutive anchors or tags. The reported impact is stack-memory corruption and a process crash.
What must an attacker do to exploit it?
The attacker needs to provide a YAML document with excess consecutive anchors or tags. No authentication privileges are required, but user interaction is required according to the supplied CVSS vector.
Are default deployments affected?
The issue occurs in release builds because the fixed two-element annotation array can be overflowed there. The provided data does not establish whether any particular application or Ubuntu package configuration parses untrusted YAML by default.
What can be done if an update cannot be applied immediately?
Do not parse YAML from untrusted sources, or reject documents containing consecutive or excess anchors and tags before they reach rapidyaml. Run YAML parsing in an isolated process where a crash has limited operational impact.