---
id: CVE-2026-115327
title: libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
summary: >-
  libyang through 6.4.13 contains an uninitialized pointer free vulnerability in
  lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action
  envelopes. Peers with a NETCONF session can send an action element containing
  non…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-824
vendor: CESNET
product: libyang
affected:
  - libyang <= 6.4.13
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:45.264Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115327'
references:
  - url: 'https://github.com/CESNET/libyang/issues/2595'
  - url: >-
      https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773
  - url: >-
      https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1330-L1342
  - url: >-
      https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1196-L1224
  - url: 'https://hackmd.io/@haindpwn/libyang-netconf-rpc-envelope-uninit-free'
  - url: 'https://github.com/CESNET/libyang'
  - url: >-
      https://www.vulncheck.com/advisories/libyang-through-6.4.13-uninitialized-pointer-free-in-netconf-rpc-parser
    label: >-
      VulnCheck Advisory: libyang through 6.4.13 Uninitialized Pointer Free in
      NETCONF RPC Parser
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.335Z'
---

## Overview

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

## Affected

- `libyang <= 6.4.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.