The vulnerability is an out-of-bounds write in the ParseEngine::_add_annotation() function, which can be triggered by feeding YAML documents with an excessive number of anchors or tags. The attack allows an adversary to overwrite stack memory, leading to arbitrary corruption of the process state or a crash, and the flaw follows the characteristics of CWE‑787. The impact is limited to the instance of the library that parses the malicious input, but a corrupted process may compromise application integrity or deny service.

The affected product is RapidYAML version 0.16.0, a C++ YAML parsing library. No other versions are mentioned, and the vulnerability is specific to the way annotations are stored in a fixed two-element array in release builds. Applications that embed this library or include it as a dependency are potentially affected if they provide untrusted YAML input to the parser.

The CVSS score of 6.9 indicates moderate severity. The event probability score (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation evidence. Because the flaw relies on user-supplied YAML containing more anchors or tags than the library is prepared to handle, the attack vector is likely local or remote depending on how the library is used. An attacker who can supply such crafted YAML can overflow the annotation array on the stack, potentially leading to crashes or kernel exploitation if privileges are high. No exploit code is publicly referenced, but the failure mode is clear from the description.