Skip to content
OpenAdvisories
Medium USN-8485-1 1 CVE

libyang vulnerability

Published Jun 30, 2026 · Updated Jun 30, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libyang incorrectly handled certain metadata list
pointers. An attacker could use this issue to cause libyang to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 25.10 libyang 3.13.5-2ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS libyang 3.13.6-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-41401

    libyang - Heap Use-After-Free Write in XML Metadata Parsing

    libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted…

    libyang libyang libyang libyang Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-41401