CVE-2026-41401

EUVD-2026-31832
libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libyang
focal
needs-triage
jammy
needs-triage
noble
dne
questing
Fixed 3.13.5-2ubuntu0.1
released
resolute
Fixed 3.13.6-1ubuntu0.1
released
libyang2
jammy
not-affected
noble
not-affected
questing
dne
resolute
dne
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libyang
Azure Linux 3.0
0:2.1.148-3.azl3
fixed
Common Weakness Enumeration
References
https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c
https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc
https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E
https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing
https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc
https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E