CVE-2026-41401

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41401
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41401.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41401
Aliases
  • GHSA-9f49-8x56-jmjc
Downstream
Related
Published
2026-05-26T14:08:48.973Z
Modified
2026-07-16T00:38:19.514352Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libyang - Heap Use-After-Free Write in XML Metadata Parsing
Details

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lydparsersetdataflags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

Database specific 
{
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41401.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "5.4.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.4.3"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.2.6"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/cesnet/libyang

Affected ranges

Type
GIT
Repo
https://github.com/cesnet/libyang
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b5ed47ee674fbe86b31bbebc4ff26889aeff38c
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v2.*
v2.0.0
v2.0.112
v2.0.194
v2.0.231
v2.0.7
v2.0.88
v2.0.97
v2.1.111
v2.1.128
v2.1.148
v2.1.30
v2.1.4
v2.1.55
v2.1.80
v2.2.8
v3.*
v3.1.0
v3.12.2
v3.13.5
v3.13.6
v3.4.2
v3.7.8
v4.*
v4.2.2

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/cesnet/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "3800006773409188817084510664528848769",
                "30977455285994984742530819484942093985",
                "112078130791577436921676239730535834315"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-41401-1183c8dd",
        "target": {
            "file": "tests/utests/schema/test_tree_schema_compile.c"
        }
    },
    {
        "source": "https://github.com/cesnet/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "130406231055418234043601844879714975581",
            "length": 41224.0
        },
        "deprecated": false,
        "id": "CVE-2026-41401-680d59f7",
        "target": {
            "function": "test_deviation",
            "file": "tests/utests/schema/test_tree_schema_compile.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-16T00:38:19Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41401.json"