CVE-2026-41401

A flaw was found in libyang. This heap use-after-free write vulnerability, specifically within the lyd_parser_set_data_flags function, occurs when the software incorrectly updates metadata list pointers during the freeing of non-head default metadata entries. A remote attacker can exploit this by submitting specially crafted YANG XML documents containing specific metadata attributes to applications that parse untrusted XML data. Successful exploitation could lead to application process to crash.

This vulnerability affects applications using libyang to process XML-encoded YANG data. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.

An authenticated attacker may supply specially crafted YANG/XML input that triggers a heap use-after-free condition during metadata parsing operations, resulting in application crashes and denial of service.

Although the vulnerability involves heap memory corruption, the current analysis and reproductions demonstrate denial-of-service impact through application crashes rather than reliable arbitrary code execution. Red Hat therefore assessed the impact as limited to Availability (A:H).

Because exploitation generally requires the ability to submit or process crafted YANG configuration data, Red Hat assessed Privileges Required as Low (PR:L).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.