CVE-2026-41401

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41401", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-20T14:15:22.223Z", "datePublished": "2026-05-26T14:08:48.973Z", "dateUpdated": "2026-11-08T14:02:59.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:59.788Z"}, "datePublic": "2026-03-26T00:00:00.000Z", "title": "libyang - Heap Use-After-Free Write in XML Metadata Parsing", "descriptions": [{"lang": "en", "value": "libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "affected": [{"vendor": "libyang", "product": "libyang", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "5.4.3"}, {"version": "5.4.3", "status": "unaffected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cesnet:libyang:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.4.3"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc", "name": "GitHub Security Advisory (GHSA-9f49-8x56-jmjc)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c", "name": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c", "tags": ["patch"]}, {"url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E", "name": "Anthropic CVD Finding ANT-2026-TZQ1KH7E", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: libyang - Heap Use-After-Free Write in XML Metadata Parsing", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing"}], "credits": [{"lang": "en", "value": "kevin-valerio", "type": "reporter"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"references": [{"url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc", "tags": ["exploit"]}, {"url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T17:57:20.352377Z", "id": "CVE-2026-41401", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T17:58:08.114Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41401", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T17:57:20.352377Z"}}}], "references": [{"url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc", "tags": ["exploit"]}, {"url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T17:56:42.716Z"}}], "cna": {"title": "libyang - Heap Use-After-Free Write in XML Metadata Parsing", "credits": [{"lang": "en", "type": "reporter", "value": "kevin-valerio"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "libyang", "product": "libyang", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.3", "versionType": "custom"}, {"status": "unaffected", "version": "5.4.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-26T00:00:00.000Z", "references": [{"url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc", "name": "GitHub Security Advisory (GHSA-9f49-8x56-jmjc)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c", "name": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c", "tags": ["patch"]}, {"url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E", "name": "Anthropic CVD Finding ANT-2026-TZQ1KH7E", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing", "name": "VulnCheck Advisory: libyang - Heap Use-After-Free Write in XML Metadata Parsing", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cesnet:libyang:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:59.788Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41401", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:02:59.788Z", "dateReserved": "2026-04-20T14:15:22.223Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-05-26T14:08:48.973Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "libyang", "vendor": "libyang", "versions": [{"lessThan": "5.4.3", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "5.4.3", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution."}, {"lang": "es", "value": "libyang anterior a la versi\u00f3n 5.2.6 contiene una vulnerabilidad de escritura de uso despu\u00e9s de liberaci\u00f3n en el heap en lyd_parser_set_data_flags que actualiza incorrectamente los punteros de la lista de metadatos al liberar entradas de metadatos predeterminadas no principales. Los atacantes pueden desencadenar esta vulnerabilidad al enviar documentos XML YANG especialmente dise\u00f1ados con atributos de metadatos espec\u00edficos a aplicaciones que analizan datos XML no confiables, causando ca\u00eddas del proceso o una posible ejecuci\u00f3n de c\u00f3digo."}], "id": "CVE-2026-41401", "lastModified": "2026-10-29T21:17:23.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41401", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T17:57:20.352377Z", "version": "2.0.3"}}]}, "published": "2026-05-26T15:16:35.660", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc"}, {"source": "disclosure@vulncheck.com", "url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libyang: libyang: Potential code execution via crafted YANG XML documents", "id": "2481478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481478"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in libyang. This heap use-after-free write vulnerability, specifically within the lyd_parser_set_data_flags function, occurs when the software incorrectly updates metadata list pointers during the freeing of non-head default metadata entries. A remote attacker can exploit this by submitting specially crafted YANG XML documents containing specific metadata attributes to applications that parse untrusted XML data. Successful exploitation could lead to application process to crash."], "name": "CVE-2026-41401", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libyang", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libyang", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libyang", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-26T14:08:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41401\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41401\nhttps://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c\nhttps://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc\nhttps://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E\nhttps://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "libyang", "vendor": "cesnet"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.4.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.4.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "libyang", "source": "cna", "vendor": "libyang"}, "product": "libyang", "vendor": "libyang"}], "created": "2026-05-26T16:00:11.895643+00:00", "updated": "2026-10-29T23:45:03.922880+00:00", "vendors": ["cesnet", "cesnet$PRODUCT$libyang", "libyang", "libyang$PRODUCT$libyang"]}