Skip to content
Fencer Vulns
medium 6.5

CVE-2026-41401 json

libyang - Heap Use-After-Free Write in XML Metadata Parsing

published 2026-05-26 5 mo ago modified 2026-11-08 22 h ago also EUVD-2026-31832

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

Patch / fix

  • libyang libyang 5.4.3
  • libyang Debian 14 6.4.13-1

debian advisories DEBIAN-CVE-2026-41401

  • libyang Ubuntu 25.10 3.13.5-2ubuntu0.1
  • libyang Ubuntu 26.04 LTS 3.13.6-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-41401

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libyang SLES 16.0, SLES for SAP applications 16.0 2.1.148-160000.4.1
  • libyang SLE Module for Server Applications 15 SP7 2.1.148-150700.3.5.1
  • libyang SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +3 more 2.1.55-150500.3.5.1
  • libyang SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.1.148-8.8.1

suse advisories SUSE-SU-2026:22200-1SUSE-SU-2026:22208-1SUSE-SU-2026:2337-1SUSE-SU-2026:2335-1SUSE-SU-2026:2334-1

  • libyang openSUSE Leap 16.0 2.1.148-160000.4.1
  • libyang openSUSE Tumbleweed 3.13.6-2.1

opensuse advisories openSUSE-SU-2026:21113-1openSUSE-SU-2026:10868-1

  • libyang Azure Linux 3.0 2.1.148-3

azure linux advisories AZL-87354

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41401 updated cvss 6.5

libyang: libyang: Potential code execution via crafted YANG XML documents

  • Red Hat Enterprise Linux 8 libyang Red Hat Enterprise Linux 9 libyang Red Hat Enterprise Linux 10 libyang
    affected: workaround, no fix available “Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc referenced PoC, tagged "exploit" by a source, unverified
  • red.anthropic.com https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 4.0 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • libyang libyang

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.