Vulnerability · Published May 26, 2026 · Assigned by VulnCheck
CVE-2026-41401libyang - Heap Use-After-Free Write in XML Metadata Parsing
Medium 6.5
In plain English
A medium-severity use-after-free in libyang from libyang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | libyang | no fix listed | DEBIAN-CVE-2026-41401 |
| Debian:14 | libyang | 6.4.13-1 | DEBIAN-CVE-2026-41401 |
| Debian:12 | libyang2 | no fix listed | DEBIAN-CVE-2026-41401 |
| Ubuntu:22.04:LTS | libyang | no fix listed | UBUNTU-CVE-2026-41401 |
| Ubuntu:25.10 | libyang | 3.13.5-2ubuntu0.1 | USN-8485-1 |
| Ubuntu:25.10 | libyang | 3.13.5-2ubuntu0.1 | UBUNTU-CVE-2026-41401 |
| Ubuntu:26.04:LTS | libyang | 3.13.6-1ubuntu0.1 | UBUNTU-CVE-2026-41401 |
| Ubuntu:26.04:LTS | libyang | 3.13.6-1ubuntu0.1 | USN-8485-1 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- GHSA Advisory GHSA-9f49-8x56-jmjc vendor-advisory
- https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c patch
- Anthropic CVD Finding ANT-2026-TZQ1KH7E third-party-advisory
- VulnCheck Advisory: libyang - Heap Use-After-Free Write in XML Metadata Parsing third-party-advisory