CVE-2026-41401 libyang - Heap Use-After-Free Write in XML Metadata Parsing
Attackers can trigger a heap use-after-free write in libyang via crafted XML, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41401?
CVE-2026-41401 is a medium-severity use after free vulnerability in libyang, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
Weakness: CWE-416
Which versions are affected by CVE-2026-41401?
Linux distribution packages (1)
libyang openSUSE:Tumbleweed | All versions | 3.13.6-2.1 |
How do I fix CVE-2026-41401?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-41401 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41401 exists.
Sources
Also known as AZL-87354, DEBIAN-CVE-2026-41401, GHSA-9f49-8x56-jmjc, GHSA-v7jp-vmx6-5429, MGASA-2026-0302, UBUNTU-CVE-2026-41401 and 2 more.