{"id":"CVE-2026-115327","summary":"libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser","details":"libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.","modified":"2026-10-23T07:29:26.394507213Z","published":"2026-10-22T10:57:45.264Z","database_specific":{"cwe_ids":["CWE-824"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115327.json","cna_assigner":"VulnCheck"},"references":[{"type":"PACKAGE","url":"https://github.com/CESNET/libyang"},{"type":"ARTICLE","url":"https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1196-L1224"},{"type":"ARTICLE","url":"https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c#L1330-L1342"},{"type":"FIX","url":"https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773"},{"type":"REPORT","url":"https://github.com/CESNET/libyang/issues/2595"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115327.json"},{"type":"ARTICLE","url":"https://hackmd.io/@haindpwn/libyang-netconf-rpc-envelope-uninit-free"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115327"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libyang-through-6.4.13-uninitialized-pointer-free-in-netconf-rpc-parser"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cesnet/libyang","events":[{"introduced":"0"},{"last_affected":"f7e0cc1bc99ec9280af1010a94ba8dd8ef448f6d"},{"fixed":"927fce908774289a7d9c07fff5704c33965c9773"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"6.4.13"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"927fce908774289a7d9c07fff5704c33965c9773"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v6.4.13","v5.8.6","v5.4.9","v4.2.2","v3.13.6","v3.13.5","v3.12.2","v3.7.8","v3.4.2","v3.1.0","v2.2.8","v2.1.148","v2.1.128","v2.1.111","v2.1.80","v2.1.55","v2.1.30","v2.1.4","v2.0.231","v2.0.194","v2.0.112","v2.0.97","v2.0.88","v2.0.7","v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115327.json","vanir_signatures":[{"digest":{"length":1480,"function_hash":"127219173254914505808157472323746584481"},"id":"CVE-2026-115327-327b51da","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773","target":{"file":"src/parser_xml.c","function":"lydxml_envelope"},"deprecated":false},{"target":{"file":"src/parser_xml.c","function":"lydxml_env_netconf_rpc"},"deprecated":false,"digest":{"function_hash":"89304728084346618856692349022599060878","length":759},"id":"CVE-2026-115327-41198225","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773"},{"id":"CVE-2026-115327-b877e767","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773","target":{"file":"tests/utests/data/test_parser_xml.c","function":"test_netconf_action"},"deprecated":false,"digest":{"function_hash":"133004501468299553494451851140188856566","length":1372}},{"signature_version":"v1","source":"https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773","target":{"file":"tests/utests/data/test_parser_xml.c"},"deprecated":false,"digest":{"line_hashes":["34402820242581308879896594684018035560","290091420301790573391585413494811141342","329604627931831201874904690791625665906"],"threshold":0.9},"id":"CVE-2026-115327-e2799cc5","signature_type":"Line"},{"source":"https://github.com/cesnet/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773","target":{"file":"src/parser_xml.c"},"deprecated":false,"digest":{"line_hashes":["45077817726510003746526369560667701733","89815909894730412669769800194434528947","50120226179681024237482715378447211955","206019831637388879909468897134896660676","130895461719858185048048813565389827712","187087213597855707824976147511232967815","135349983010433318764970120739176184398","49421772754878239733954977611393772258","14332617606014411928961524990655320242","220317124417081831654119108981684880074","186935084167174191759726124751242915819","90095811017536858794938434005905521260","122217780528346330322757994972438253670","41133116026508366863126198981547244852","280955922252125900571918507590316326082","19645497847909710288906136773093466692","60468662296056258605853004236675441894","116892101799624841360017640394159551675","170367393310265252841774939953653189609","14551811868752667407977141340990718326","51875506560324174422980349184896978538","218687344447093980971624364297291327840","53156663697226177085758346536651476834","200597402398952177489347857757514696233","285104481203209980910130785464684827816"],"threshold":0.9},"id":"CVE-2026-115327-e6e5739d","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-23T07:29:26Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}