Use-after-free in libyang - #VU163177
Published: November 9, 2026
Vulnerability identifier: #VU163177
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unprivileged local attacker to crash applications that parse untrusted YANG schemas with libyang, causing denial of service.
The vulnerability exists due to a heap use-after-free in extension-instance path construction when parsing a YANG type containing multiple pattern statements. An unprivileged local attacker can supply a crafted schema and induce a victim to parse it through lys_parse_mem() or lys_parse(), triggering a freed-memory read and application crash.
Affected software
libyang
Remediation
Install security update from vendor's website.
libyang - update to 5.8.6