Junglewise Threat Intelligence

CVE-2026-44673: CESNET libyang heap buffer overflow in lyb_read_string

CVE-2026-44673 · Severity: high · CVSS 7.5 · Published 2026-05-14

Executive brief

libyang is a software library used to process YANG data models, commonly found in network management tools like NETCONF servers. A vulnerability in how the library handles specific binary data could allow an attacker to crash the service or potentially gain unauthorized control over the system. This could lead to a total service outage or a security breach in critical networking infrastructure.

Technical details

An integer overflow exists in the lyb_read_string() function within src/parser_lyb.c when processing LYB binary blobs. Specifically, a maliciously crafted string length (e.g., 0xFFFFFFFF) causes a wrap-around during memory allocation (malloc(0)) and a subsequent massive out-of-bounds read/write during the memcpy operation. The vulnerability can be triggered remotely without authentication if the target application (such as a NETCONF server or sysrepo) accepts untrusted LYB data. This results in heap corruption, leading to a crash (DoS) or potential arbitrary code execution (RCE). The issue is resolved in version SO 5.2.15.

Affected products

  • CESNET libyang < SO 5.2.15
  • Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

  • 2026-04-07: advisory: Initial advisory published by CESNET/libyang
  • 2026-05-14: disclosed: CVE-2026-44673 published
  • 2026-06-08: patched: Red Hat released security updates for RHEL 8
  • 2026-06-09: patched: Red Hat released security updates for RHEL 10

References

Related threats