YAML::Syck versions up to 1.36 for Perl contain a notably severe heap buffer overflow in the YAML emitter that is triggered when class names exceed a 512‑byte allocation. The overflow can corrupt adjacent memory blocks and potentially lead to unintended code execution or program termination. Additional weaknesses include a base64 decoder overread on trailing newlines, a mutating token that corrupts shared node data, and a memory leak when adding anchors. These vulnerabilities are consistent with the CWE‑120 and CWE‑122 categories, which describe heap-based buffer overflows and incorrect bounds checking.

The affected component is the Perl module YAML::Syck, distributed by the TODDR vendor. Any Perl application that loads this module—whether a web service, a command‑line tool, or any process that parses YAML files—is at risk. The problem exists in all releases through version 1.36. Upgrading to version 1.37 or later removes the known defects, because the vendor has fixed the allocation and bounds checks that were responsible for the overflow.

The CVSS score of 9.1 indicates high severity, but the EPSS score is reported as less than 1%, which suggests that active exploitation is currently rare and the vulnerability is not listed in the CISA KEV catalog. The exact attack vector is not explicitly detailed in the advisory; based on the description it is inferred that an attacker would need to supply malformed or malicious YAML input to the vulnerable module, such as via network traffic, file uploads, or other data feeds that are parsed by the application. Because the vulnerability requires untrusted YAML data, the risk is mitigated if an application validates or sanitizes input, but if such controls are absent the potential for arbitrary code execution remains high. Overall, the combination of high impact and the possibility of remote exploitation makes patching a priority.