{"id":"CVE-2026-115327","kind":"vulnerability","aliases":["CVE-2026-115327"],"related":[],"title":"libyang: uninitialized pointer free in NETCONF parser allows crash or heap corruption","description":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","summary":"libyang's XML parser frees an uninitialized pointer in lydxml_env_netconf_rpc() when it reads NETCONF rpc action envelopes. A peer with a NETCONF session can send an action element with non-whitespace text to crash the server, such as netopeer2, or corrupt its heap.","severity":"medium","cvss":6.0,"epss":0.00307,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["libyang","netconf","netopeer2","network-automation","package"],"not_affected_if":["no-netconf-server"],"how_to_check":"- Check the installed libyang version with `yanglint --version` or `pkg-config --modversion libyang` and compare it against the affected range through 6.4.13.\n- Look for netopeer2 or other NETCONF servers linked against libyang on hosts that accept NETCONF sessions.","fix":"- Move libyang past 6.4.13 to a release that includes the fix; the exact fixed version is unknown from the sources.\n- Rebuild or update NETCONF servers such as netopeer2 against the patched libyang.","status":"open","published_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:05:28+00:00","updated_at":"2026-10-25T04:05:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move libyang past 6.4.13 to a release that includes the fix; the exact fixed version is unknown from the sources.\n- Rebuild or update NETCONF servers such as netopeer2 against the patched libyang.","reach":"network","title":"libyang: uninitialized pointer free in NETCONF parser allows crash or heap corruption","impact":"medium","summary":"libyang's XML parser frees an uninitialized pointer in lydxml_env_netconf_rpc() when it reads NETCONF rpc action envelopes. A peer with a NETCONF session can send an action element with non-whitespace text to crash the server, such as netopeer2, or corrupt its heap.","category":"package","nicknames":[],"who_cares":["libyang","netconf","netopeer2","network-automation"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote NETCONF peer crashes server or corrupts its heap memory","analyst_note":"Confirm the fixed libyang release and whether an authenticated NETCONF session is required, via the NVD entry for CVE-2026-115327 and the libyang project changelog.","how_to_check":"- Check the installed libyang version with `yanglint --version` or `pkg-config --modversion libyang` and compare it against the affected range through 6.4.13.\n- Look for netopeer2 or other NETCONF servers linked against libyang on hosts that accept NETCONF sessions.","needs_analyst":true,"not_affected_if":["no-netconf-server"],"who_is_affected":"Systems that run a NETCONF server built on libyang and accept sessions from peers, so an authenticated or reachable NETCONF client can reach the rpc action parser. Hosts that do not expose NETCONF sessions are unlikely to be exposed; the sources do not say whether NETCONF authentication is required before the parser runs.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":3394,"output_tokens":671,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115327':15A,18A '-2026':14A,17A '6.4.13':75C 'action':44B,55B,93C,103C 'allow':8A 'autom':24B 'contain':76C,105C 'corrupt':12A,70B,120C 'crash':9A,63B,115C 'cve':13A,16A 'element':56B,104C 'env':36B,84C 'envelop':45B,94C 'free':4A,30B,80C 'heap':11A,72B,122C 'libyang':1A,19B,26B,73C 'like':117C 'lyd':111C 'lydxml':35B,83C 'netconf':6A,20B,37B,42B,50B,85C,91C,98C 'netopeer2':21B,68B,118C 'network':23B 'network-autom':22B 'non':59B,107C 'non-whitespac':58B,106C 'op':113C 'packag':25B 'pars':90C,112C 'parser':7A,29B 'peer':47B,95C 'pointer':3A,33B,79C 'read':41B 'rpc':38B,43B,86C,92C 'send':53B,101C 'server':65B,116C 'session':51B,99C 'src/parser_xml.c':88C 'text':61B,109C 'uniniti':2A,32B,78C 'via':110C 'vulner':81C 'whitespac':60B,108C 'xml':28B","nicknames":[],"mitigations":[],"who_affected":"Systems that run a NETCONF server built on libyang and accept sessions from peers, so an authenticated or reachable NETCONF client can reach the rpc action parser. Hosts that do not expose NETCONF sessions are unlikely to be exposed; the sources do not say whether NETCONF authentication is required before the parser runs.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115327","severity":null,"published_at":"2026-10-22T11:17:51+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115327","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115327","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}