CVE-2026-115327
libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
CESNET libyang
CVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
Text from CVE List
Affected versions 1
- libyangaffected: all versions through 6.4.13CVE List
References 7
- github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773Fixvia CVE List
- vulncheck.com/advisories/libyang-through-6.4.13-uninitialized-pointer-free-in-netconf-rpc-parserAdvisoryvia CVE List
- github.com/CESNET/libyang/issues/2595Referencevia CVE List
- github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1330-L1342Referencevia CVE List
- github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1196-L1224Referencevia CVE List
- hackmd.io/@haindpwn/libyang-netconf-rpc-envelope-uninit-freeReferencevia CVE List
- github.com/CESNET/libyangReferencevia CVE List