# CVE-2026-44673: CESNET libyang heap buffer overflow in lyb_read_string

Source: https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-44673 · Severity: high · CVSS 7.5 · Published 2026-05-14

libyang is a software library used to process YANG data models, commonly found in network management tools like NETCONF servers. A vulnerability in how the library handles specific binary data could allow an attacker to crash the service or potentially gain unauthorized control over the system. This could lead to a total service outage or a security breach in critical networking infrastructure.

Technologies: [CESNET Libyang](https://junglewise.ai/threats/technologies/libyang), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [CESNET](https://junglewise.ai/threats/vendors/cesnet), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-44673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44673 being exploited in the wild.

**How severe is CVE-2026-44673?** High severity, with a CVSS score of 7.5, published 14 May 2026.

**Which products and versions are affected?** CESNET Libyang < SO 5.2.15, Prior to SO 5.2.15; Red Hat Enterprise Linux AppStream 8, 9, 10.

**Is there a fix for CVE-2026-44673?** A patch was published on 2026-06-08: Red Hat released security updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44673 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44673?** Check whether you run CESNET Libyang or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow exists in the lyb_read_string() function within src/parser_lyb.c when processing LYB binary blobs. Specifically, a maliciously crafted string length (e.g., 0xFFFFFFFF) causes a wrap-around during memory allocation (malloc(0)) and a subsequent massive out-of-bounds read/write during the memcpy operation. The vulnerability can be triggered remotely without authentication if the target application (such as a NETCONF server or sysrepo) accepts untrusted LYB data. This results in heap corruption, leading to a crash (DoS) or potential arbitrary code execution (RCE). The issue is resolved in version SO 5.2.15.

## Affected products

- CESNET libyang < SO 5.2.15
- Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10

## Timeline

- 2026-04-07: advisory: Initial advisory published by CESNET/libyang
- 2026-05-14: disclosed: CVE-2026-44673 published
- 2026-06-08: patched: Red Hat released security updates for RHEL 8
- 2026-06-09: patched: Red Hat released security updates for RHEL 10

## References

- [https://github.com/CESNET/libyang/security/advisories/GHSA-vw2p-pq79-92xh](https://github.com/CESNET/libyang/security/advisories/GHSA-vw2p-pq79-92xh)
- [https://access.redhat.com/errata/RHSA-2026:24545](https://access.redhat.com/errata/RHSA-2026:24545)
- [https://access.redhat.com/errata/RHSA-2026:24758](https://access.redhat.com/errata/RHSA-2026:24758)
- [https://access.redhat.com/errata/RHSA-2026:25051](https://access.redhat.com/errata/RHSA-2026:25051)
- [https://access.redhat.com/security/cve/CVE-2026-44673](https://access.redhat.com/security/cve/CVE-2026-44673)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2477617](https://bugzilla.redhat.com/show_bug.cgi?id=2477617)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44673.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44673.json)

## Related threats

- [libyang uninitialized pointer free in NETCONF RPC parsing](https://junglewise.ai/threats/cve-2026-115327-libyang-through-6-4-13-contains-an-uninitialized-pointer-free)
- [CESNET libyang heap use-after-free in lyd_parser_set_data_flags](https://junglewise.ai/threats/cve-2026-41401-cesnet-libyang-heap-use-after-free-in-lyd-parser-set-data-flags)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)