CVE-2026-41401 Details
Description
libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
A heap use-after-free write vulnerability has been identified in libyang versions prior to 5.2.6. The issue arises in the function lyd_parser_set_data_flags, where the metadata list head pointer is improperly updated when freeing non-head default metadata entries. This vulnerability can be exploited by submitting crafted YANG XML documents with specific metadata attributes to applications that parse untrusted XML data. The exploitation of this vulnerability can lead to process crashes or potentially allow for code execution, depending on the application's heap management.
Users are advised to update libyang to version 5.2.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E | CISA-ADP | Content Wall |
| https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c | [email protected] | Source CodeVendor |
| https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E | [email protected] | Content Wall |
| https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CESNET libyang | <= 5.2.5 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |