CVE-2026-115327 in libyang
Summary
by MITRE • 10/23/2026
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in libyang versions up to 6.4.13 represents a critical memory management flaw within the XML parsing subsystem, specifically located in the lydxml_env_netconf_rpc function found in src/parser_xml.c. This issue arises during the processing of NETCONF remote procedure call envelopes, which are fundamental components for managing network devices via the Network Configuration Protocol. The core technical defect is an uninitialized pointer free operation, a severe class of memory corruption error that typically leads to application crashes or potential arbitrary code execution depending on the heap state at the time of exploitation. When libyang processes incoming NETCONF data, it relies on internal pointers to manage dynamic memory allocations for XML nodes and attributes. In this specific scenario, the parsing logic fails to properly initialize a pointer before attempting to deallocate it later in the execution flow. This lapse occurs when handling action elements that contain non-whitespace text, triggering a path where the code attempts to free memory associated with an invalid or garbage address rather than a valid heap allocation.
From an operational perspective, this vulnerability allows any peer established with a NETCONF session to trigger a denial of service condition against servers such as netopeer2, which is a widely used reference implementation for NETCONF that relies heavily on libyang for data modeling and parsing. By sending a crafted action element containing non-whitespace text through the lyd_parse_op function, an attacker can induce a segmentation fault or similar crash in the server process. Beyond simple denial of service, heap corruption resulting from freeing uninitialized pointers poses significant security risks. It may allow sophisticated attackers to manipulate memory structures, potentially leading to information disclosure or remote code execution if the corrupted pointer values align with exploitable patterns within the application's memory layout. This is particularly dangerous because NETCONF sessions are often established over trusted management networks, but in many modern architectures, these interfaces may be exposed to less controlled environments or managed by third-party systems that could be compromised.
This vulnerability maps directly to CWE-416, Use After Free, although the specific manifestation here involves freeing an uninitialized pointer which is closely related to CWE-908, Use of Uninitialized Resource. The failure lies in the lack of proper initialization checks before memory deallocation routines are invoked. In the context of the MITRE ATT&CK framework, this flaw facilitates initial access or impact categories such as Denial of Service (T1499) and potentially Execution if heap exploitation techniques are employed. Attackers can leverage this to disrupt network management operations, causing outages in critical infrastructure that depends on automated configuration changes via NETCONF. The absence of robust input validation and memory safety checks in the parsing logic highlights a gap in secure coding practices for handling external XML data streams.
Mitigation strategies must focus on immediate patching and defensive programming enhancements. Organizations running libyang versions prior to 6.4.13 should upgrade to the latest stable release where this issue has been resolved by ensuring pointers are properly initialized before any deallocation occurs. Developers integrating libyang into their applications should implement strict input validation for NETCONF action envelopes, particularly scrutinizing text content within action elements to ensure it conforms to expected formats and does not trigger edge cases in the parser. Additionally, deploying runtime application self-protection mechanisms or memory safety tools can help detect such anomalies during testing phases before deployment. Regular security audits of XML parsing logic are essential to prevent similar uninitialized resource vulnerabilities from being introduced in future updates.