Uninitialized Pointer Free Vulnerability in libyang by CESNET
CVE-2026-115327

6MEDIUM

Key Information:

Vendor

Cesnet

Status
Libyang
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115327?

The libyang library, a tool for manipulating YANG data models, contains a significant vulnerability affecting versions up to 6.4.13. Specifically, this issue arises from an uninitialized pointer in the lydxml_env_netconf_rpc() function found in src/parser_xml.c, which processes NETCONF RPC action envelopes. When a peer sends a malicious action element containing non-whitespace text through the lyd_parse_op() function, it can lead to server crashes or heap corruption, posing a serious risk to applications and services utilizing libyang such as netopeer2.

Affected Version(s)

libyang 0 <= 6.4.13

References

https://github.com/CESNET/libyang/issues/2595
issue-tracking
https://github.com/CESNET/libyang/commit/927fce908774289a...
patch
https://github.com/CESNET/libyang/blob/v6.4.13/src/parser...
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
Mar (mardgez13)
.