{"id":"CVE-2026-115327","aliases":["AZL-110492","DEBIAN-CVE-2026-115327","EUVD-2026-108129","GHSA-x4q2-x59g-x339","UBUNTU-CVE-2026-115327","openSUSE-SU-2026:12301-1"],"status":"published","title":"libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00314,"percentile":0.24705,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-824"],"published":"2026-10-22T10:57:45Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"libyang","fixed_in":["3.13.6-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.148-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.2-1","3.13.5-1","3.13.5-2","3.13.6-1","3.13.6-1~bpo13+1","4.2.2-1","4.2.2-2","4.2.2-3","4.3.3-1","4.3.4-1","4.7.3-1","5.0.2-1","5.0.8-1","5.4.1+really5.4.1-1","5.4.1-1","5.4.5-1","5.4.9-1","5.7.1-1","5.8.5-1","5.8.6-1","5.8.6-2","6.1.4-1","6.4.13-1","6.4.3-1","6.4.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.2-1","3.13.5-1","3.13.5-2","3.13.6-1","3.13.6-1~bpo13+1","4.2.2-1","4.2.2-2","4.2.2-3","4.3.3-1","4.3.4-1","4.7.3-1","5.0.2-1","5.0.8-1","5.4.1+really5.4.1-1","5.4.1-1","5.4.5-1","5.4.9-1","5.7.1-1","5.8.5-1","5.8.6-1","5.8.6-2","6.1.4-1","6.4.13-1","6.4.3-1","6.4.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libyang2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.148-0.1","2.1.148-0.2","2.1.30-2","2.1.30-2.1","2.1.30-2.1~exp1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.105-1","0.16.105-2","0.16.105-3","0.16.105-3build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.225-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyang2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.112-6","2.0.112-6ubuntu1","2.0.112-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libyang2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.30-2","2.1.30-2.1","2.1.30-2.1build1","2.1.30-2.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.6-1","3.13.6-1ubuntu1","6.1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.5-2","3.13.6-1","3.13.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libyang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.6-4.1"}]}]}],"products":[{"vendor":"cesnet","product":"libyang"}],"references":[{"url":"https://github.com/CESNET/libyang/issues/2595","tags":["issue-tracking","report"]},{"url":"https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773","tags":["patch","fix","report"]},{"url":"https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1330-L1342","tags":["technical-description","article","report"]},{"url":"https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1196-L1224","tags":["technical-description","article","report"]},{"url":"https://hackmd.io/@haindpwn/libyang-netconf-rpc-envelope-uninit-free","tags":["technical-description","article","report"]},{"url":"https://github.com/CESNET/libyang","tags":["product","package","report"]},{"url":"https://www.vulncheck.com/advisories/libyang-through-6.4.13-uninitialized-pointer-free-in-netconf-rpc-parser","tags":["third-party-advisory","advisory","report"]},{"url":"https://hackmd.io/@haindpwn/cve-2026-115327-libyang-netconf-rpc-envelope-uninit-free","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115327","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x4q2-x59g-x339"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115327.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-115327","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-115327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115327","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115327","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-115327","title":"libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T10:57:45.264Z","modified":"2026-10-29T02:10:37.665Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-824"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-108129","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T10:57:45Z","modified":"2026-10-29T02:10:37Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:18.059516Z"}],"ghsa":[{"id":"GHSA-x4q2-x59g-x339","title":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in...","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T12:31:17Z","modified":"2026-10-29T06:30:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-824"],"updated_at":"2026-11-02T15:14:37.567324Z"}],"nvd":[{"id":"CVE-2026-115327","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T11:17:51.73Z","modified":"2026-10-29T04:18:26.023Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-824"],"updated_at":"2026-11-02T14:13:02.724605Z"}],"osv":[{"id":"CVE-2026-115327","title":"libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T10:57:45.264Z","modified":"2026-10-30T07:16:36.431268829Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-824"],"updated_at":"2026-11-02T15:44:56.675758Z"},{"id":"DEBIAN-CVE-2026-115327","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T11:17:51.73Z","modified":"2026-10-29T10:00:16.889417382Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"UBUNTU-CVE-2026-115327","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T11:17:00Z","modified":"2026-10-28T17:50:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-110492","title":"CVE-2026-115327 affecting package libyang 2.1.148-3","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","status":"published","published":"2026-10-22T11:17:51Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"openSUSE-SU-2026:12301-1","title":"libyang-devel-3.13.6-4.1 on GA media","description":"These are all security issues fixed in the libyang-devel-3.13.6-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:15.823822505Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}