---
id: CVE-2026-41401
title: libyang - Heap Use-After-Free Write in XML Metadata Parsing
summary: >-
  libyang before 5.4.3 contains a heap use-after-free write vulnerability in
  lyd_parser_set_data_flags that incorrectly updates metadata list pointers when
  freeing non-head default metadata entries. Attackers can trigger this
  vulnerability…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: libyang
product: libyang
affected:
  - libyang < 5.4.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-26T17:57:20.352377Z'
exploitAvailable: true
published: '2026-05-26'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:59.788Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-41401'
references:
  - url: 'https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc'
    label: GitHub Security Advisory (GHSA-9f49-8x56-jmjc)
  - url: >-
      https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c
    label: >-
      https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c
  - url: 'https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E'
    label: Anthropic CVD Finding ANT-2026-TZQ1KH7E
  - url: >-
      https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing
    label: >-
      VulnCheck Advisory: libyang - Heap Use-After-Free Write in XML Metadata
      Parsing
tags:
  - cve.org
  - exploit-available
epss: 0.00673
epssPercentile: 0.52392
ingestedAt: '2026-11-03T08:39:35.548Z'
---

## Overview

libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

## Affected

- `libyang < 5.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.