CVE-2026-75432

EUVD-2026-84854
An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.1 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.65%
Debian logo
Debian Releases
Debian Product
Codename
yaml-cpp
bookworm
0.7.0+dfsg-8
fixed
forky
0.9.0+dfsg-10
fixed
sid
0.9.0+dfsg-10
fixed
trixie
0.8.0+dfsg-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
yaml-cpp
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/jbeder/yaml-cpp/issues/1475
https://github.com/jbeder/yaml-cpp/pull/1476
https://github.com/jbeder/yaml-cpp/issues/1475