p PatchFirst

CVE-2026-41401

CVE-2026-41401 · libyang - Heap Use-After-Free Write in XML Metadata Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

CVSS 6.9 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libyang

    Versions
    • ≥ 0, < 5.4.3: Affected (custom)
    • 5.4.3: Not affected (custom)

    Update to 5.4.3

  • libyang Debian:13

    Versions
    • 3.12.2-1
    • 3.13.5-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.6-1~bpo13+1
    • 4.2.2-1
    • 4.2.2-2
    • 4.2.2-3
    • 4.3.3-1
    • 4.3.4-1
    • 4.7.3-1
    • 5.0.2-1
    • 5.0.8-1
    • 5.4.1+really5.4.1-1
    • 5.4.1-1
    • 5.4.5-1
    • 5.4.9-1
    • 5.7.1-1
    • 5.8.5-1
    • 5.8.6-1
    • 5.8.6-2
    • 6.1.4-1
    • 6.4.13-1
    • 6.4.3-1
    • 6.4.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Debian:14

    Versions
    • 3.12.2-1
    • 3.13.5-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.6-1~bpo13+1
    • 4.2.2-1
    • 4.2.2-2
    • 4.2.2-3
    • 4.3.3-1
    • 4.3.4-1
    • 4.7.3-1
    • 5.0.2-1
    • 5.0.8-1
    • 5.4.1+really5.4.1-1
    • 5.4.1-1
    • 5.4.5-1
    • 5.4.9-1
    • 5.7.1-1
    • 5.8.5-1
    • 5.8.6-1
    • 5.8.6-2
    • 6.1.4-1
    • 6.4.3-1
    • 6.4.6-1
    Affected ranges
    • ECOSYSTEM: < 6.4.13-1

    Update to 6.4.13-1

  • libyang2 Debian:12

    Versions
    • 2.1.148-0.1
    • 2.1.148-0.2
    • 2.1.30-2
    • 2.1.30-2.1
    • 2.1.30-2.1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:20.04:LTS

    Versions
    • 0.16.105-1
    • 0.16.105-2
    • 0.16.105-3
    • 0.16.105-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:22.04:LTS

    Versions
    • 1.0.225-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libyang Ubuntu:25.10

    Versions
    • 3.7.8-3
    • 3.12.2-1
    • 3.12.2-1ubuntu1
    • 3.13.5-2
    Affected ranges
    • ECOSYSTEM: < 3.13.5-2ubuntu0.1

    Update to 3.13.5-2ubuntu0.1

  • libyang Ubuntu:26.04:LTS

    Versions
    • 3.13.5-2
    • 3.13.6-1
    Affected ranges
    • ECOSYSTEM: < 3.13.6-1ubuntu0.1

    Update to 3.13.6-1ubuntu0.1

Original sources

Check your server →