CVE-2026-115327

The record

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

Affected packages

Related vulnerabilities

• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-824
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-824
• CVE-2026-88054 Tesseract is an open source OCR engine. CWE-824
• CVE-2026-54920 OpenEXR is the reference implementation and specification for the EXR image format… CWE-824
• CVE-2026-16409 Invalid pointer in the Security: PSM component. CWE-824
• CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component. CWE-824
• CVE-2026-47908 Dreamweaver Desktop versions 21.7 and earlier are affected by an Access of Uninitialized… CWE-824
• CVE-2026-47320 Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open… CWE-824