The flaw lies in YAML::Syck’s base64 decoder, which uses a signed char to index a static 256‑entry table (b64_xtable). When a !!binary scalar contains any byte with the high bit set, the signed char sign‑extends to a negative value, causing the decoder to read memory locations before the table. The data read from these out‑of‑bounds addresses then appears in the decoded result, allowing an attacker to exfiltrate arbitrary memory contents from the process. This vulnerability is a classic case of CWE‑125: Out‑of‑Bounds Read. The likely attack vector is delivering a crafted YAML document containing a !!binary scalar with high‑bit bytes.

Perl modules that import YAML::Syck version 1.46 or earlier, as released by TODDR, are affected. Any Perl application that calls Load or LoadFile on untrusted YAML input will hit the base64 decoder on the default Load path, as the !!binary type is not gated by $LoadBlessed or $LoadCode. Thus the vulnerability applies across all Perl programs that rely on this module to parse external YAML.

The CVSS score of 9.1 indicates a high‑severity information disclosure. The EPSS score of less than 1% suggests that exploit activity is presently rare, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw simply by delivering a crafted YAML document containing a !!binary scalar with one or more high‑bit bytes; no special privileges or pre‑existing access are required. Based on the description, it is inferred that the exploit can read arbitrary memory content, and the resulting information disclosure can vary widely depending on the process.