CVE-2026-115327
MediumCVSS 5.3Summary
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
Risk Assessment
A remote attacker with a NETCONF session can cause a denial of service or memory corruption, potentially leading to code execution or service outage.
Recommendation
Upgrade libyang above 6.4.13 and restrict NETCONF session access to trusted peers until the fix is deployed.
Other vulnerabilities in libyang
See all- CVE-2026-41401Medium
libyang before version 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can submit crafted YANG XML documents, potentially causing process crashes or code execution.
- CVE-2026-44673High
In libyang library prior to SO 5.2.15, an integer overflow in lyb_read_string() in src/parser_lyb.c leads to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption.
Original NVD description (English source)
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS