An issue in yaml‑cpp 0.9.0 allows an unauthorized remote attacker to obtain sensitive information by exploiting the scanner’s PopIndent and PushIndentTo functions. The flaw enables the attacker to read data that should not be exposed, potentially revealing configuration or secret material stored in YAML files. The vulnerability does not provide code execution or denial‑of‑service capabilities; its primary consequence is loss of confidentiality.

library version 0.9.0. While no vendor is listed, yaml‑cpp is widely adopted in numerous open‑source projects, so any system that incorporates this version of the library is potentially vulnerable.

The CVSS score of 5.1 and EPSS < 1% indicate moderate severity but low exploitation probability, and the vulnerability is not listed in KEV. Based on the description, it is inferred that a remote attacker can trigger the problem by sending a crafted YAML document where mismatched indentation causes the scanner to expose hidden data. Because the bug resides in a core parsing routine, it does not require elevated privileges and could be leveraged from an untrusted input source, making it a real risk for deployments that process YAML from external parties.