CVE-2026-75432

Low risk· EPSS 11%

Published: 22/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components.

Risk Assessment

An attacker can remotely access sensitive information processed by applications using yaml-cpp. This may lead to leakage of confidential data.

Recommendation

Update yaml-cpp to a version newer than 0.9.0 once a fix is available. Until then, consider limiting the processing of untrusted YAML data.

Other vulnerabilities in yaml-cpp

CVE-2017-11692High
The function 'Token& Scanner::peek' in yaml-cpp version 0.5.3 and earlier allows remote attackers to cause a denial of service via a '!2' string.

Original NVD description (English source)

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components