Heap Use-After-Free Vulnerability in libyang Affects Applications Parsing Untrusted XML

CVE-2026-41401

What is CVE-2026-41401?

The libyang library, prior to version 5.2.6, contains a heap use-after-free write vulnerability within the lyd_parser_set_data_flags function. This issue occurs due to improper handling of metadata list pointers when freeing non-head default metadata entries. Attackers can exploit this flaw by sending specially crafted YANG XML documents containing malicious metadata attributes to applications that process untrusted XML data. Successful exploitation may lead to application crashes or potential execution of arbitrary code, posing significant risks to affected systems.

References