CVE-2026-41401

MediumCVSS 6.5

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

41th percentile - higher than 41% of all known CVEs

Summary

libyang before version 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can submit crafted YANG XML documents, potentially causing process crashes or code execution.

Risk Assessment

An attacker can remotely cause a process crash or potentially execute code in the context of the application parsing untrusted XML data.

Recommendation

Upgrade libyang to version 5.2.6 or later, which includes a fix.

Other vulnerabilities in libyang

CVE-2026-44673High
In libyang library prior to SO 5.2.15, an integer overflow in lyb_read_string() in src/parser_lyb.c leads to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption.

Original NVD description (English source)

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.