libyang EUVD-2026-108129

Requires an established NETCONF session with the target (PR:L) - the description states 'peers with a NETCONF session' - so exploitation is limited to authenticated/authorized NETCONF peers, not anonymous remote attackers. The specific trigger is a NETCONF rpc 'action' envelope parsed via lyd_parse_op() with LYD_TYPE_RPC_NETCONF where the <action> element contains non-whitespace character data; this reaches the uninitialized/non-NULL pointer free in lydxml_envelope()/lydxml_env_netconf_rpc() in src/parser_xml.c. Affected deployments are products that embed libyang ≤6.4.13 for NETCONF rpc/action parsing (e.g. netopeer2). Limiting factors: the authenticated-session requirement, and that reliability of the outcome (crash vs. exploitable heap corruption) is memory-state dependent and not shown to be attacker-controlled (AC:H/AT:P).

This is a moderate-priority, authenticated denial-of-service / heap-corruption flaw rather than a drop-everything emergency, and the signals are largely consistent. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores it 6.0 with impact confined to availability (VC:N/VI:N/VA:H) - i.e. crash/heap corruption, not confirmed code execution or data disclosure. PR:L confirms the attacker must already hold a valid NETCONF session, which is a meaningful limiter: this is reachable by authenticated/authorized peers, not anonymous internet attackers. AC:H and AT:P indicate the outcome is not fully attacker-controlled - the test case shows the trigger (non-whitespace text in an <action> envelope) is simple, but whether it yields a clean crash or exploitable heap corruption is memory-state dependent and not described as controllable in the sources. No EPSS score and no KEV listing were supplied, and no confirmed active exploitation is indicated; a public PoC/write-up reference exists but is not verified as working weaponized exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a patch-in-normal-cycle posture. Net: a credible DoS against NETCONF servers (e.g. netopeer2) by authenticated peers, worth patching this cycle but not matching the risk profile of an unauthenticated RCE.

An attacker who already holds a valid NETCONF session against a libyang-backed server (such as netopeer2) sends an rpc action envelope whose <action> element contains non-whitespace text; libyang frees an uninitialized pointer while parsing, crashing the server or corrupting the heap. A public write-up/PoC reference exists (hackmd), and the vendor's regression test reproduces the parse condition, but it is not verified as working weaponized exploit code. Exploitation is network-reachable (AV:N) but requires the authenticated session (PR:L) and the outcome is not reliably attacker-controlled (AC:H/AT:P).