{"cve":"CVE-2026-41401","nvd":{"published":"2026-05-26T15:16:35.660","modified":"2026-10-29T21:17:23.027","status":"Deferred","description":"libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-416"],"references":["https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c","https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc","https://red.anthropic.com/2026/cvd/findings/ANT-2026-TZQ1KH7E","https://www.vulncheck.com/advisories/libyang-heap-use-after-free-write-in-xml-metadata-parsing","https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc"],"products":[],"source":"nvd","synced_at":"2026-10-29T21:36:56.436249234+00:00"},"epss":{"cve":"CVE-2026-41401","score":0.00673,"percentile":0.52045,"date":"2026-10-29"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}