libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to applications parsing untrusted XML data, causing process crashes or potential code execution.

The remote Ubuntu 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8485-1 advisory.

    It was discovered that libyang incorrectly handled certain metadata list pointers. An attacker could use     this issue to cause libyang to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22208-1 advisory.

    This update for libyang fixes the following issues

    - CVE-2026-41401: use-after-free in `lyd_parser_set_data_flags` when processing crafted YANG XML documents     with specific       metadata attributes (bsc#1266316).
    - CVE-2026-44673: integer overflow in `lyb_read_string()` of `src/parser_lyb.c` leads to heap buffer     overflow when       parsing a maliciously crafted LYB binary blob (bsc#1265330).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2334-1 advisory.

    This update for libyang fixes the following issues

    - CVE-2026-41401: use-after-free in `lyd_parser_set_data_flags` when processing crafted YANG XML documents     with specific       metadata attributes (bsc#1266316).
    - CVE-2026-44673: integer overflow in `lyb_read_string()` of `src/parser_lyb.c` leads to heap buffer     overflow when       parsing a maliciously crafted LYB binary blob (bsc#1265330).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2337-1 advisory.

    This update for libyang fixes the following issues

    - CVE-2026-41401: use-after-free in `lyd_parser_set_data_flags` when processing crafted YANG XML documents     with specific       metadata attributes (bsc#1266316).
    - CVE-2026-44673: integer overflow in `lyb_read_string()` of `src/parser_lyb.c` leads to heap buffer     overflow when       parsing a maliciously crafted LYB binary blob (bsc#1265330).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2335-1 advisory.

    This update for libyang fixes the following issues

    - CVE-2026-41401: use-after-free in `lyd_parser_set_data_flags` when processing crafted YANG XML documents     with specific       metadata attributes (bsc#1266316).
    - CVE-2026-44673: integer overflow in `lyb_read_string()` of `src/parser_lyb.c` leads to heap buffer     overflow when       parsing a maliciously crafted LYB binary blob (bsc#1265330).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that     incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can     trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to     applications parsing untrusted XML data, causing process crashes or potential code execution.
    (CVE-2026-41401)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325002	Ubuntu 25.10 / 26.04 LTS : libyang vulnerability (USN-8485-1)	Nessus	Ubuntu Local Security Checks	high
323097	SUSE SLES16 Security Update : libyang (SUSE-SU-2026:22208-1)	Nessus	SuSE Local Security Checks	high
321038	SUSE SLES12 Security Update : libyang (SUSE-SU-2026:2334-1)	Nessus	SuSE Local Security Checks	high
321015	SUSE SLES15 Security Update : libyang (SUSE-SU-2026:2337-1)	Nessus	SuSE Local Security Checks	high
320996	SUSE SLES15 Security Update : libyang (SUSE-SU-2026:2335-1)	Nessus	SuSE Local Security Checks	high
317298	Linux Distros Unpatched Vulnerability : CVE-2026-41401	Nessus	Misc.	high

Detections

Analytics

CVE-2026-41401

high

Tenable Plugins

high

high

high

high

high

high