CVE-2026-115327
libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
| CWE | CWE-824 |
| Vendor | cesnet |
| Product | libyang |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for cesnet libyang
Be the first to know when new medium vulnerabilities affecting cesnet libyang are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
CESNET / libyang
0 ≤ 6.4.13
References
github.com: https://github.com/CESNET/libyang/issues/2595 github.com: https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773 github.com: https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1330-L1342 github.com: https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1196-L1224 hackmd.io: https://hackmd.io/@haindpwn/libyang-netconf-rpc-envelope-uninit-free github.com: https://github.com/CESNET/libyang vulncheck.com: https://www.vulncheck.com/advisories/libyang-through-6.4.13-uninitialized-pointer-free-in-netconf-rpc-parser
Credits
HaiND from the Post and Telecommunication Institute of Technology Mar (mardgez13)