CVE-2026-44673: CESNET libyang heap buffer overflow in lyb_read_string

CVE-2026-44673 · Severity: high · CVSS 7.5 · Published 2026-05-14

libyang is a software library used to process YANG data models, commonly found in network management tools like NETCONF servers. A vulnerability in how the library handles specific binary data could allow an attacker to crash the service or potentially gain unauthorized control over the system. This could lead to a total service outage or a security breach in critical networking infrastructure.

Technologies: CESNET Libyang, Red Hat Enterprise Linux AppStream. Vendors: CESNET, Red Hat.

Quick answers

Is CVE-2026-44673 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44673 being exploited in the wild.
How severe is CVE-2026-44673?
High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?
CESNET Libyang < SO 5.2.15, Prior to SO 5.2.15; Red Hat Enterprise Linux AppStream 8, 9, 10.
Is there a fix for CVE-2026-44673?
A patch was published on 2026-06-08: Red Hat released security updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44673 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44673?
Check whether you run CESNET Libyang or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow exists in the lyb_read_string() function within src/parser_lyb.c when processing LYB binary blobs. Specifically, a maliciously crafted string length (e.g., 0xFFFFFFFF) causes a wrap-around during memory allocation (malloc(0)) and a subsequent massive out-of-bounds read/write during the memcpy operation. The vulnerability can be triggered remotely without authentication if the target application (such as a NETCONF server or sysrepo) accepts untrusted LYB data. This results in heap corruption, leading to a crash (DoS) or potential arbitrary code execution (RCE). The issue is resolved in version SO 5.2.15.

Affected products

  • CESNET libyang < SO 5.2.15
  • Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

  • 2026-04-07: advisory: Initial advisory published by CESNET/libyang
  • 2026-05-14: disclosed: CVE-2026-44673 published
  • 2026-06-08: patched: Red Hat released security updates for RHEL 8
  • 2026-06-09: patched: Red Hat released security updates for RHEL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.