CVE-2026-41401: libyang - Heap Use-After-Free Write in XML Metadata Parsing
Last updated 30 June 2026
Other sources
libyang - Heap Use-After-Free Write in XML Metadata Parsing
— Microsoft
libyang before 5.2.6 contains a heap use-after-free write vulnerability in lydparsersetdataflags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
— Launchpad
libyang before 5.4.3 contains a heap use-after-free write vulnerability in lydparsersetdataflags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libyangto a version that resolves this vulnerability.Fixed in 6.4.13-1 - Upgrade
Upgrade
ubuntu/libyangto a version that resolves this vulnerability.Fixed in 3.13.5-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/libyangto a version that resolves this vulnerability.Fixed in 3.13.6-1ubuntu0.1 - Upgrade
Upgrade
libyangto a version that resolves this vulnerability.Fixed in 5.2.6 - Upgrade
Upgrade
libyangto a version that resolves this vulnerability.Fixed in 5.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41401?
The severity of CVE-2026-41401 is rated medium with a score of 6.5.
What type of vulnerability is found in CVE-2026-41401?
CVE-2026-41401 is a heap use-after-free write vulnerability.
How can attackers exploit CVE-2026-41401?
Attackers can exploit CVE-2026-41401 by submitting crafted YANG XML documents with specific metadata.
How do I fix CVE-2026-41401?
To fix CVE-2026-41401, update libyang to version 5.2.6 or later.
Which software is affected by CVE-2026-41401?
The affected software for CVE-2026-41401 is libyang, specifically versions prior to 5.2.6.