CVE-2026-41401
libyang - Heap Use-After-Free Write in XML Metadata Parsing
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
| CWE | CWE-416 |
| Vendor | libyang |
| Product | libyang |
| Published | May 26, 2026 |
| Last Updated | May 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for libyang libyang
Be the first to know when new medium vulnerabilities affecting libyang libyang are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
libyang / libyang
0 < 5.4.3
References
github.com: https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc github.com: https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c red.anthropic.com: https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E vulncheck.com: https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing
Credits
🔍 kevin-valerio