CVE-2026-41401

Name	CVE-2026-41401
Description	libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149179

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libyang (PTS)	trixie	3.12.2-1	vulnerable
	forky	3.13.6-1	vulnerable
	sid	6.4.13-1	vulnerable
libyang2 (PTS)	bookworm	2.1.30-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libyang	source	(unstable)	(unfixed)			1149179
libyang2	source	(unstable)	(unfixed)

Notes

[trixie] - libyang <no-dsa> (Minor issue)
[bullseye] - libyang <no-dsa> (Minor issue)
[bookworm] - libyang2 <no-dsa> (Minor issue)
https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc
Fixed by: https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04 (v5.4.9)