Stack Exhaustion in libfyaml via Malicious YAML Document

Executive Summary

CVE-2026-88359 is a stack exhaustion vulnerability in libfyaml 0.9.6's fy_atom_iter_format() function. When processing a specially crafted YAML document with very large literal or folded block scalars, the function repeatedly grows an internal buffer using alloca() inside a loop. Since alloca() memory is only freed when the function returns, cumulative stack growth can exceed the process stack limit, causing SIGSEGV and denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using libfyaml 0.9.6 when processing large YAML files. Check for SIGSEGV errors during YAML parsing or text extraction. Use tools like strace or gdb to trace stack usage during processing of malformed YAML inputs with excessive empty lines or large block scalars.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing applications that use libfyaml 0.9.6 when processing malicious YAML inputs. The crash occurs either during parsing or text extraction, depending on the build type. Exploitable remotely and unauthenticated, it may disrupt services relying on libfyaml for YAML processing.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade libfyaml to a patched version (post-fix commits) that replaces alloca() with heap allocation or enforces size limits. If upgrading is not possible, restrict YAML parsing to trusted inputs and implement size limits for block scalars. Monitor for crashes in affected applications.

Useful 0 Not Useful 0