Description
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
Published: 2026-10-22
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability in libyang is triggered during parsing of NETCONF RPC action envelopes when an uninitialized pointer in lydxml_env_netconf_rpc() is freed. This flaw can cause the process to crash or corrupt the heap, resulting in a denial of service and potentially unstable server operation.

Affected Systems

The affected vendor is CESNET, and the vulnerability exists in libyang library releases up to and including version 6.4.13. Systems that embed libyang in NETCONF servers or clients, such as netopeer2, are at risk unless they upgrade to a patched version.

Risk and Exploitability

The CVSS score of 6 indicates moderate severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits. Attackers would need access to an exposed NETCONF session to send a crafted action element with non‑whitespace text. The description indicates this can crash the server or corrupt the heap; the potential for code execution is an inference not confirmed in the documentation and is therefore uncertain.

Generated by OpenCVE AI on October 22, 2026 at 12:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libyang to a version newer than 6.4.13 where the uninitialized pointer free is fixed
  • Apply the patch from commit 927fce908774289a7d9c07fff5704c33965c9773 if a newer release is not immediately available
  • Configure the NETCONF server to reject or validate action elements that contain non‑whitespace text, mitigating the risk until a full patch is deployed

Generated by OpenCVE AI on October 22, 2026 at 12:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
Title libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
First Time appeared Cesnet
Cesnet libyang
Weaknesses CWE-824
CPEs cpe:2.3:a:cesnet:libyang:*:*:*:*:*:*:*:*
Vendors & Products Cesnet
Cesnet libyang
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Cesnet Libyang
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T10:57:45.264Z

Reserved: 2026-10-22T10:37:07.419Z

Link: CVE-2026-115327

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T11:17:51.730

Modified: 2026-10-22T11:17:51.730

Link: CVE-2026-115327

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T13:00:07Z

Weaknesses
  • CWE-824

    Access of Uninitialized Pointer