PatchSiren cyber security CVE debrief

CVE-2026-115327 CESNET CVE debrief

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap. This vulnerability affects libyang installations, particularly those with exposed NETCONF sessions, potentially leading to system crashes or heap corruption. Defenders should assess their exposure, prioritize patching, and implement compensating controls to restrict NETCONF access.

Vendor: CESNET
Product: libyang
CVSS: MEDIUM 6
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-22
Original CVE updated: 2026-10-29
Advisory published: 2026-10-22
Advisory updated: 2026-10-29

Who should care

Defenders responsible for systems using libyang, especially those with NETCONF sessions exposed, should assess their exposure and prioritize patching to prevent potential system crashes or heap corruption.

Why it matters

Defenders should care about CVE-2026-115327 because it affects libyang through 6.4.13, allowing peers with NETCONF sessions to potentially crash servers or corrupt the heap. Verification and patching of libyang installations, especially those exposed to NETCONF, are crucial. The vulnerability's impact requires defenders to assess their exposure, prioritize patching, and implement compensating controls to restrict NETCONF access.

Potential system crashes due to uninitialized pointer free
Heap corruption from malicious NETCONF rpc action envelopes
Need for verification of libyang version and exposure to NETCONF sessions
Priority on patching libyang installations to prevent exploitation

Technical summary

The libyang library through version 6.4.13 has an uninitialized pointer free vulnerability in the lydxml_env_netconf_rpc() function in src/parser_xml.c. This vulnerability occurs when parsing NETCONF rpc action envelopes. An attacker with a NETCONF session can exploit this by sending an action element containing non-whitespace text via lyd_parse_op(), potentially crashing servers like netopeer2 or corrupting the heap.

Defensive priority

Defenders should prioritize verifying and patching libyang installations, especially those exposed to NETCONF sessions, to prevent potential crashes or heap corruption.

Recommended defensive actions

Verify libyang version and exposure to NETCONF sessions
Patch libyang installations to version beyond 6.4.13 if available
Monitor for unusual NETCONF session activity
Implement compensating controls to restrict NETCONF access
Review asset inventory for systems using libyang with NETCONF sessions
Plan for rollback/change windows for patching
Track source of vulnerability details for further updates

Evidence notes

The CVE record and source item provide details on the vulnerability, including its location in src/parser_xml.c and the affected version 6.4.13. However, the corpus does not establish versions beyond 6.4.13, exploitation, impact, or remediation for all affected systems.

Sources and references

Verified primary and authoritative sources

CVE-2026-115327 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-115327

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-115327 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115327

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115327.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://github.com/CESNET/libyang/issues/2595

Supplemental source - issue-tracking
Source reference
Unverified legacy reference

URL: https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773

Supplemental source - patch
Source reference
Unverified legacy reference

URL: https://github.com/CESNET/libyang/blob/v6.4.13/src/parser_xml.c

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://hackmd.io/@haindpwn/libyang-netconf-rpc-envelope-uninit-free

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://github.com/CESNET/libyang

Supplemental source - product
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/libyang-through-6.4.13-uninitialized-pointer-free-in-netconf-rpc-parser

Supplemental source - third-party-advisory
Source reference
Unverified legacy reference

URL: https://hackmd.io/@haindpwn/cve-2026-115327-libyang-netconf-rpc-envelope-uninit-free

Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.