CVE-2026-120455

Medium

Description

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.

SeverityMedium

CVSS6.1

Exploit probability—

ProductBiojppm Rapidyaml

PublishedNov 2, 2026

First seenNov 4, 2026

Weakness typeCWE-787Out-of-bounds write

How to fix

Vendor advisories

github.com/biojppm/rapidyaml/releases/tag/v0.16.0

Affected products

Product	Affected versions	Fixed in
biojppm rapidyaml	v ≤ 0.16.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.