CVE-2026-41401: libyang Use-After-Free Vulnerability

CVE-2026-41401 Overview

CVE-2026-41401 is a heap use-after-free write vulnerability in libyang versions before 5.2.6. The flaw resides in the lyd_parser_set_data_flags function, which incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger the issue by submitting crafted YANG XML documents containing specific metadata attributes to applications that parse untrusted XML data. Successful exploitation can crash the parsing process or potentially lead to code execution within the host application. The vulnerability is classified under CWE-416 Use After Free.

Critical Impact

Remote attackers with low privileges can corrupt heap memory in any application linking libyang to parse YANG-modeled XML, producing high-impact availability loss and potential arbitrary code execution.

Affected Products

• CESNET libyang versions prior to 5.2.6
• Network management and NETCONF/RESTCONF tooling linking vulnerable libyang builds
• Applications parsing untrusted YANG-modeled XML data via lyd_parser_set_data_flags

Discovery Timeline

• 2026-05-26 - CVE-2026-41401 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41401

Vulnerability Analysis

The vulnerability lives in libyang, the C library used to parse, validate, and manipulate YANG-modeled data within NETCONF, RESTCONF, and similar network configuration stacks. When the parser processes XML metadata attributes on data nodes, lyd_parser_set_data_flags walks the linked list of default metadata entries and frees entries marked as defaults. The function mismanages the list head and successor pointers when the freed entry is not the head node, leaving dangling references that the parser later writes to.

Because attacker-controlled XML drives both the structure of the metadata list and the order in which entries get freed, an attacker can shape the heap layout to land a controlled write into a previously freed allocation. This is a classic exploitation primitive that can pivot from a crash into code execution depending on the allocator and surrounding heap state.

Root Cause

The root cause is incorrect list pointer maintenance during metadata cleanup. When lyd_parser_set_data_flags releases a non-head default metadata node, the predecessor's next pointer and the global list head are not updated atomically, leaving stale pointers into freed memory. Subsequent writes through those stale pointers produce a use-after-free write [CWE-416]. The upstream fix in commit 6b5ed47ee674fbe86b31bbebc4ff26889aeff38c re-sequences the unlink and free operations so the list invariants hold before any deallocation.

Attack Vector

Exploitation requires the attacker to deliver a crafted YANG XML document to a target service that parses untrusted XML with libyang. Common channels include NETCONF over SSH, RESTCONF over HTTPS, and any management API that accepts YANG-modeled payloads. The attacker needs only low privileges to submit data, and no user interaction is required. The vulnerability does not directly compromise confidentiality or integrity, but it inflicts high impact on availability and can serve as a stepping stone for code execution depending on the host process. Refer to the VulnCheck Advisory on libyang for further technical context.

Detection Methods for CVE-2026-41401

Indicators of Compromise

• Unexpected crashes, SIGSEGV signals, or AddressSanitizer reports from processes linking libyang immediately after parsing inbound XML
• NETCONF or RESTCONF sessions submitting unusually large or deeply nested metadata attributes on data nodes
• Core dumps showing faulting instructions inside lyd_parser_set_data_flags or adjacent metadata handling routines

Detection Strategies

• Inventory all binaries and containers linking libyang and verify the linked version is 5.2.6 or later
• Enable AddressSanitizer or heap canaries in staging to surface use-after-free writes during XML parsing fuzzing
• Alert on repeated parser crashes correlated with specific source IPs submitting YANG payloads

Monitoring Recommendations

• Capture process telemetry, including child process termination reasons, for daemons handling NETCONF, RESTCONF, or YANG-driven APIs
• Log full request bodies for management plane APIs to support post-incident reconstruction of malicious XML inputs
• Correlate authentication events with parser failures to identify low-privilege accounts probing the management interface

How to Mitigate CVE-2026-41401

Immediate Actions Required

• Upgrade libyang to version 5.2.6 or later across all hosts, containers, and embedded firmware
• Rebuild and redeploy applications statically linked against vulnerable libyang versions
• Restrict NETCONF, RESTCONF, and other YANG-consuming endpoints to authenticated administrative networks

Patch Information

The fix is available upstream in the GitHub Commit Update and documented in the GitHub Security Advisory. Distributions packaging libyang should rebuild against 5.2.6. The vulnerability was tracked through coordinated disclosure as detailed in the Anthropic CVD Findings.

Workarounds

• Reject or filter inbound XML containing default metadata attributes at an upstream proxy until patching completes
• Run libyang-dependent parsers under reduced privileges and within sandboxes such as seccomp or systemd hardening units
• Enforce strict authentication and rate limiting on management plane interfaces to reduce exposure to crafted YANG payloads

# Verify installed libyang version on Debian/Ubuntu and Red Hat systems
dpkg -l | grep -i libyang
rpm -qa | grep -i libyang

# Confirm fixed version is 5.2.6 or later before re-enabling NETCONF/RESTCONF
ldconfig -p | grep libyang