CVE-2026-75432: yaml-cpp Information Disclosure Flaw

CVE-2026-75432 Overview

CVE-2026-75432 is an information disclosure vulnerability in yaml-cpp version 0.9.0. The flaw resides in the scanner component, specifically within src/scanner.cpp and the Scanner::PopIndent() and Scanner::PushIndentTo() functions. A remote attacker can leverage the issue to obtain sensitive information from applications that parse untrusted YAML input using the affected library.

yaml-cpp is a widely deployed C++ YAML parser embedded in configuration tooling, DevOps pipelines, and application runtimes. Exposure depends on whether an application processes attacker-controlled YAML documents.

Critical Impact
A remote attacker can trigger the flaw in Scanner::PopIndent() or Scanner::PushIndentTo() to extract sensitive information from processes that parse untrusted YAML input.

Affected Products

yaml-cpp 0.9.0
Applications statically or dynamically linking yaml-cpp 0.9.0
Downstream distributions packaging yaml-cpp 0.9.0

Discovery Timeline

2026-09-22 - CVE-2026-75432 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75432

Vulnerability Analysis

The issue exists in the scanner subsystem of yaml-cpp 0.9.0. YAML uses indentation to define document structure, and the scanner tracks indentation state through a stack managed by Scanner::PushIndentTo() and Scanner::PopIndent(). Improper handling of indentation state during scanning permits a remote attacker to obtain sensitive information from the parsing process.

Because yaml-cpp is embedded in many services that ingest YAML from users, files, or network sources, the impact scales with the sensitivity of the process memory or data exposed during parsing. Applications that accept YAML from untrusted sources are directly reachable.

Root Cause

The root cause lies in the indentation-tracking logic within src/scanner.cpp. The Scanner::PopIndent() and Scanner::PushIndentTo() functions manage the indentation stack as tokens are produced. Discussion in the upstream GitHub Issue Discussion and the proposed fix in the GitHub Pull Request Submission identify the scanner state-handling paths as the location of the defect.

Attack Vector

Exploitation requires a target application to parse a crafted YAML document supplied by the attacker. The delivery channel depends on the host application: HTTP APIs consuming YAML bodies, CI/CD pipelines evaluating pipeline definitions, configuration reloaders, and Kubernetes tooling are common exposure surfaces. No authentication is required against the library itself; the attacker only needs a path to submit YAML input.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS data records a probability of 0.221% as of 2026-09-24.

A sanitized exploitation code sample is not available. Refer to the upstream issue and pull request linked above for the technical reproduction context.

Detection Methods for CVE-2026-75432

Indicators of Compromise

Unexpected YAML parsing errors or scanner exceptions logged by applications linked against yaml-cpp 0.9.0.
Inbound requests submitting unusually structured YAML with irregular or deeply manipulated indentation patterns.
Process memory anomalies or crashes correlated with YAML input processing endpoints.

Detection Strategies

Inventory all binaries and containers that statically or dynamically link libyaml-cpp and flag those reporting version 0.9.0.
Instrument applications that call yaml-cpp to log the source, size, and origin of parsed YAML documents for anomaly review.
Add web application firewall or API gateway rules to flag YAML payloads with atypical indentation sequences targeting scanner logic.

Monitoring Recommendations

Monitor application logs for repeated parser failures originating from a small set of client IPs or accounts.
Correlate outbound data volumes from services that parse YAML with request patterns to identify potential information leakage.
Track software bill of materials (SBOM) drift so that reintroduction of yaml-cpp 0.9.0 into builds triggers an alert.

How to Mitigate CVE-2026-75432

Immediate Actions Required

Identify all services and container images that ship yaml-cpp 0.9.0 and prioritize those exposed to untrusted YAML input.
Restrict which callers can submit YAML to affected endpoints using authentication, allowlists, or network segmentation.
Validate and constrain YAML input size and structure at the application boundary before passing it to the parser.

Patch Information

At the time of publication, the fix is tracked in the upstream GitHub Pull Request Submission, which addresses the scanner indentation handling discussed in the GitHub Issue Discussion. Consumers should rebuild against a yaml-cpp release that incorporates this change or apply the patch to vendored copies of the library.

Workarounds

Reject YAML input from untrusted sources until the patched library is deployed.
Isolate YAML parsing into a sandboxed process with minimal privileges and no access to sensitive secrets or memory regions.
Convert accepted formats to JSON at a trusted gateway and disable YAML ingestion paths where feasible.

bash

# Configuration example: identify binaries linked against vulnerable yaml-cpp
ldconfig -p | grep -i yaml-cpp
find / -name 'libyaml-cpp*' 2>/dev/null -exec sh -c 'echo {}; strings {} | grep -E "^0\.9\.0$"' \;