libyang before 5.2.6 contains a heap use‑after‑free write vulnerability in the function lyd_parser_set_data_flags. The error occurs when the code updates metadata list pointers after freeing non‑head default metadata entries, which can lead to memory corruption. Attackers can trigger the flaw by submitting specially crafted YANG XML documents with particular metadata attributes to applications that parse untrusted XML data, potentially causing a process crash or enabling execution of arbitrary code.

The affected product is libyang, maintained by CESNET. All releases prior to version 5.2.6 are vulnerable; applications that integrate libyang in this range are at risk.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA KEV. The likely attack vector is remote: an attacker can send crafted YANG XML documents to a vulnerable system over any interface that allows XML parsing, thereby provoking the use‑after‑free condition and potentially gaining code execution. The exploitation requires that the target application exposes a parsing endpoint to untrusted input.