AIKIDO-2026-11069
psych is vulnerable to Heap-based Buffer Overflow
31
Low Risk
This Affects:
psychTL;DR
The io_reader callback in the libyaml C extension copies RSTRING_LEN bytes from the value returned by the wrapping Ruby IO#read into libyaml's fixed-capacity buffer without validating the returned length against the requested size. When a non-standard IO-like object's #read over-returns, the memcpy writes past the end of libyaml's buffer, causing a heap out-of-bounds write reachable through Psych.load, Psych.safe_load, and Psych.parse. The fix clamps the copy length to the requested buffer size before the memcpy.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
psych is vulnerable to Heap-based Buffer Overflow in versions 2.0.0 - 5.3.1.
How to fix this
Upgrade the psych library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant