> CVE-2026-88359

« BACK_TO_HOME
PUBLISHED
2026-09-24 14:18
MODIFIED
2026-09-24 14:18
EPSS (Prob. Exploit)
0.25%
Top 84.9%
DATA SOURCES:
NVD 🔗 2026-09-24 FIRST EPSS 🔗 2026-10-22 OSV 🔗 2026-10-19

> DESCRIPTION

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown

> HISTORIQUE DES MODIFICATIONS

Première apparition
24/09/2026 14:18
Source: NVD
Total des modifications: 0 Dernière mise à jour: 4 weeks ago

> REFERENCES

https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2...
https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817...
https://github.com/pantoniou/libfyaml/issues/315
« BACK_TO_HOME