Every CVE Search/ Get API key

CVE-2026-115327

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

6.0 MediumFix available

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.31%Unchanged since Oct 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.0

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
CVE-2026-115327
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-824
Updated
2026-11-02
EUVDEUVD-2026-108129 6.0

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
EUVD-2026-108129
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x4q2-x59g-x339 6.0

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in...

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
GHSA-x4q2-x59g-x339
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-824
Updated
2026-11-02
NVD 6.0

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
CVE-2026-115327
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-824
Updated
2026-11-02
OSV 6.0

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
CVE-2026-115327
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-824
Updated
2026-11-02
OSVDEBIAN-CVE-2026-115327 6.0

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
DEBIAN-CVE-2026-115327
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-115327 6.0

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
UBUNTU-CVE-2026-115327
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-110492 No score

CVE-2026-115327 affecting package libyang 2.1.148-3

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Record
AZL-110492
Updated
2026-11-05
OSVopenSUSE-SU-2026:12301-1 No score

libyang-devel-3.13.6-4.1 on GA media

These are all security issues fixed in the libyang-devel-3.13.6-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12301-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libyang
Azure Linux:3
 through 2.1.148-3 None known
libyang
Debian:13
 All versions, plus listed versions
3.12.2-13.13.5-13.13.5-23.13.6-13.13.6-1~bpo13+1
Show 20 moreShow less
4.2.2-14.2.2-24.2.2-34.3.3-14.3.4-14.7.3-15.0.2-15.0.8-15.4.1+really5.4.1-15.4.1-15.4.5-15.4.9-15.7.1-15.8.5-15.8.6-15.8.6-26.1.4-16.4.13-16.4.3-16.4.6-1
 None known
libyang
Debian:14
 All versions, plus listed versions
3.12.2-13.13.5-13.13.5-23.13.6-13.13.6-1~bpo13+1
Show 20 moreShow less
4.2.2-14.2.2-24.2.2-34.3.3-14.3.4-14.7.3-15.0.2-15.0.8-15.4.1+really5.4.1-15.4.1-15.4.5-15.4.9-15.7.1-15.8.5-15.8.6-15.8.6-26.1.4-16.4.13-16.4.3-16.4.6-1
 None known
libyang2
Debian:12
 All versions, plus listed versions
2.1.148-0.12.1.148-0.22.1.30-22.1.30-2.12.1.30-2.1~exp1
 None known
libyang
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.16.105-10.16.105-20.16.105-30.16.105-3build1
 None known
libyang
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.0.225-1.1
 None known
libyang2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.112-62.0.112-6ubuntu12.0.112-6ubuntu2
 None known
libyang2
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.1.30-22.1.30-2.12.1.30-2.1build12.1.30-2.1ubuntu0.1
 None known
libyang
Ubuntu:26.10
 All versions, plus listed versions
3.13.6-13.13.6-1ubuntu16.1.4-1
 None known
libyang
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.13.5-23.13.6-13.13.6-1ubuntu0.1
 None known
libyang
openSUSE:Tumbleweed
 before 3.13.6-4.1
3.13.6-4.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-115327 is a medium vulnerability (CVSS 6.0) in Cesnet Libyang, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in libyang 3.13.6-4.1.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open