CVE-2026-41401
mediumlibyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freei…
libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c disclosure@vulncheck.com
- https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc disclosure@vulncheck.com
- https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-par... disclosure@vulncheck.com
- https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E 134c704f-9b21-4f2e-91b3-4a467353bcc0