YAML::Syck versions before 1.47 contain an out‑of‑bounds read caused by an unbounded newline scan during block‑scalar lexing. The lexer dereferences a pointer one byte beyond the heap buffer when encountering a block scalar at a document boundary, exposing data located beyond the intended buffer. This flaw can leak sensitive information to an attacker, as it is classified as CWE‑125.

The affected product is YAML‑Syck for Perl, published by the vendor TODDR. All releases prior to version 1.47 are susceptible; version 1.47 and later include the fix.

The vulnerability has a CVSS score of 7.7, indicating high risk of information disclosure. Its EPSS score of less than 1 % and lack of listing in KEV suggest a low current exploitation probability, though the severity remains significant. An attacker must supply an untrusted YAML document containing a block scalar at a document boundary, which when processed by the vulnerable module via Load or LoadFile leads to an out‑of‑bounds read that can expose adjacent memory contents. The exploit relies on the lexer path that was not fully addressed by the earlier fix for CVE‑2025‑11683, meaning the same scenario applies to earlier patched versions that did not cover this path.