Dashboard / CVE-2026-41401

CVE-2026-41401

MEDIUM
MEDIUM Priority: 0.05 BB Relevance: 64/100
Published: 2026-05-26 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: None
VA: High

Description

libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
libyang libyang 0 < 5.4.3
libyang libyang 0 < 5.4.3

References & Advisories (4)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.67%
Raw Score 0.006730
Percentile 52.0%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links