---
id: CVE-2026-120455
title: >-
  rapidyaml through 0.16.0 Out-of-Bounds Write via
  ParseEngine::_add_annotation()
summary: >-
  rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in
  ParseEngine::_add_annotation() that allows attackers to corrupt memory by
  supplying YAML with excess anchors or tags. Attackers can submit YAML with
  consecutive an…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: biojppm
product: rapidyaml
affected:
  - rapidyaml <= 0.16.0
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:29:12.335Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120455'
references:
  - url: 'https://github.com/biojppm/rapidyaml/issues/680'
  - url: >-
      https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L4307-L4351
  - url: >-
      https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L5524-L5535
  - url: >-
      https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hpp#L249-L260
  - url: 'https://github.com/biojppm/rapidyaml/releases/tag/v0.16.0'
    label: rapidyaml v0.16.0 Release Notes
  - url: 'https://hackmd.io/@haindpwn/rapidyaml-parser-annotation-oob-write'
  - url: >-
      https://www.vulncheck.com/advisories/rapidyaml-through-0.16.0-out-of-bounds-write-via-parseengine-add-annotation
    label: >-
      VulnCheck Advisory: rapidyaml through 0.16.0 Out-of-Bounds Write via
      ParseEngine::_add_annotation()
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.0194
ingestedAt: '2026-11-05T19:30:42.661Z'
---

## Overview

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.

## Affected

- `rapidyaml <= 0.16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.