CVE-2023-26917 Null dereference in n/a

High 7.5 Published 11 Apr 2023 Updated 11 Feb 2025

A NULL pointer dereference in libyang allows attackers to cause a denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-26917?

CVE-2023-26917 is a high-severity vulnerability in n/a, published on 11 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.

Weakness: CWE-476

Which versions are affected by CVE-2023-26917?

It affects 1 product.

Products include Cesnet Libyang.

How do I fix CVE-2023-26917?

Upgrade to a fixed version.

Is CVE-2023-26917 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26917 exists.

Sources

Also known as AZL-26153, CLSA-2026-1786710499, DEBIAN-CVE-2023-26917, GHSA-8fpx-68qp-g9qc, UBUNTU-CVE-2023-26917.