libyang before 5.4.3 contains a heap use-after-free write vulnerability in the function lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger the flaw by submitting specially crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, potentially causing a process crash or enabling execution of arbitrary code.

The affected product is libyang, maintained by CESNET. All releases prior to version 5.4.3 are vulnerable; applications that integrate libyang in this range are at risk.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of 0.00673 indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is remote: an attacker can send crafted YANG XML documents to a vulnerable system over any interface that allows XML parsing, thereby provoking the use-after-free condition and potentially gaining code execution. The exploitation requires that the target application exposes a parsing endpoint to untrusted input.