azure linux libyang vulnerabilities

Latest azure linux libyang CVEs

Newest publication first

1. CVE-2026-41401 libyang - Heap Use-After-Free Write in XML Metadata Parsing

   Published 2026-05-26

   Medium·CVSS 6.9 EPSS 0.67%

   libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents w...

2. CVE-2026-44673 libyang: lyb_read_string() integer overflow → heap buffer overflow

   Published 2026-05-14

   High·CVSS 7.5

   libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.