CVE-2026-120455 — Vulnerability intelligence

—

Published: 2026-11-02T15:17:29.117

CVSS

6.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.

Sources

• CVE-2026-120455
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory