Skip to main content

libyang EUVDEUVD-2026-31832

| CVE-2026-41401 HIGH
Use After Free (CWE-416)
2026-05-26 VulnCheck GHSA-v7jp-vmx6-5429
Use After Free Memory Corruption RCE Libyang
7.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Jun 08, 2026 - 10:32 vuln.today
Analysis Generated
Jun 08, 2026 - 10:32 vuln.today
Severity Changed
May 26, 2026 - 15:22 NVD
MEDIUM HIGH
CVSS changed
May 26, 2026 - 15:22 NVD
6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

AnalysisAI

Heap use-after-free write in libyang before 5.2.6 enables remote authenticated attackers to crash processes or potentially execute code by submitting crafted YANG XML documents to applications using the library for parsing. The flaw resides in lyd_parser_set_data_flags, which mishandles metadata list pointers when freeing non-head default metadata entries. No public exploit identified at time of analysis, EPSS is low at 0.03%, and SSVC rates technical impact as partial with no automatable exploitation.

Technical ContextAI

libyang is the CESNET-maintained C library that parses, validates, and manipulates YANG-modeled data, widely embedded in network management stacks including sysrepo, FRRouting, and Red Hat/SUSE platform tooling for NETCONF/RESTCONF processing. The vulnerability is a CWE-416 Use-After-Free in the XML metadata parsing path: lyd_parser_set_data_flags incorrectly updates the linked-list pointers of default metadata entries when a non-head entry is freed, leaving a dangling pointer that is later written to. Because libyang sits at the XML-to-internal-tree boundary, any application that hands attacker-influenced YANG XML to the parser inherits the bug. The affected CPE is cpe:2.3:a:libyang:libyang covering all versions before the fixed release.

RemediationAI

Upgrade libyang to the patched release identified by CESNET (the CVE text cites 5.2.6; the EUVD record implies 5.4.3 - confirm the exact version via the GHSA-9f49-8x56-jmjc advisory at https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc, with the fix commit at https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c). For Red Hat and SUSE deployments, apply the distribution-provided libyang package update once published. Where immediate patching is not possible, restrict the ability of low-privileged users to submit arbitrary YANG XML to NETCONF/RESTCONF or sysrepo endpoints by tightening NACM/AAA rules and network ACLs on management interfaces, and consider validating or rejecting client-supplied XML containing unexpected metadata attributes at a proxy; the trade-off is potential disruption of legitimate management automation that relies on those metadata extensions.

More in Libyang

View all
CVE-2023-26917 HIGH POC
7.5 Apr 11

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validat
CVE-2021-28906 HIGH POC
7.5 May 20

In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. Rated

CVE-2021-28905 HIGH POC
7.5 May 20

In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. Rated high

CVE-2021-28904 HIGH POC
7.5 May 20

In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. Rated high

CVE-2021-28903 HIGH POC
7.5 May 20

A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). Rated high sev
CVE-2021-28902 HIGH POC
7.5 May 20

In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. R
CVE-2019-19334 CRITICAL
9.8 Dec 06

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG fi
CVE-2019-19333 CRITICAL
9.8 Dec 06

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG fi
CVE-2023-26916 MEDIUM
5.3 Apr 03

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-31832 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy