RapidYAML Out-of-Bounds Write via Excess Anchors

Executive Summary

This is an out-of-bounds write vulnerability in the rapidyaml library through version 0.16.0. It occurs in the ParseEngine::_add_annotation() function where a fixed two-element array is used to store annotations. When YAML input contains three or more consecutive anchors or tags, the array overflows, corrupting stack memory and potentially crashing the process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect YAML inputs processed by rapidyaml v0.16.0 or earlier for consecutive anchors or tags. Test with inputs like flow-style YAML `[&a &b &c x]` or block-style YAML with three lines of tags `!a`, `!b`, `!c`. If parsing crashes or produces unexpected behavior, the system may be vulnerable.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause memory corruption leading to application crashes. While it does not directly enable arbitrary code execution or information disclosure, the stack corruption could potentially lead to denial of service or unstable behavior in applications using rapidyaml for YAML parsing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a memory corruption issue in a YAML parser library. It may indirectly affect compliance if the library is used in systems handling sensitive data, potentially leading to crashes or undefined behavior that could disrupt data processing or security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rapidyaml to a patched version where the capacity check in `_add_annotation` is always enforced. If upgrading is not possible, avoid processing untrusted YAML inputs with excessive anchors or tags until a fix is applied.

Useful 0 Not Useful 0