GHSA-9f49-8x56-jmjc: libyang - Heap Use-After-Free Write in XML Metadata Parsing

Q: Which deployments are exposed to this issue?

Applications using CESNET libyang versions before 5.4.3 are exposed if they parse untrusted YANG XML documents. The vulnerable path is XML metadata parsing.

Q: What does an attacker need to exploit it?

An attacker needs the ability to submit a crafted YANG XML document containing specific metadata attributes to an application that parses it. No user interaction is indicated, but the attacker requires low-level privileges according to the supplied vector.

Q: What is the likely impact of successful exploitation?

Successful exploitation can crash the affected process and may allow code execution. The supplied impact vector indicates high availability impact, while confidentiality and integrity impacts are not indicated.

Q: How can I determine whether I am affected?

Check whether the application uses CESNET libyang earlier than version 5.4.3 and accepts or processes untrusted YANG XML input with metadata attributes. Such deployments should be treated as affected until updated.

Published May 26, 2026

Updated

libyang before 5.4.3 contains a heap use-after-free write vulnerability in lydparsersetdataflags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

Affected Software

1 affected component

CESNET libyang<5.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libyang to a version that resolves this vulnerability.
Fixed in 5.4.3

Event History

May 26, 2026

CVE Published

via OSV·02:08 PM

Data Sourced

via OSV·02:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using CESNET libyang versions before 5.4.3 are exposed if they parse untrusted YANG XML documents. The vulnerable path is XML metadata parsing.

What does an attacker need to exploit it?

An attacker needs the ability to submit a crafted YANG XML document containing specific metadata attributes to an application that parses it. No user interaction is indicated, but the attacker requires low-level privileges according to the supplied vector.

What is the likely impact of successful exploitation?

Successful exploitation can crash the affected process and may allow code execution. The supplied impact vector indicates high availability impact, while confidentiality and integrity impacts are not indicated.

How can I determine whether I am affected?

Check whether the application uses CESNET libyang earlier than version 5.4.3 and accepts or processes untrusted YANG XML input with metadata attributes. Such deployments should be treated as affected until updated.

GHSA-9f49-8x56-jmjc: libyang - Heap Use-After-Free Write in XML Metadata Parsing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

How can I determine whether I am affected?