CVE-2026-44673

A flaw was found in libyang, a YANG data modeling language library. An integer overflow in the lyb_read_string() function can lead to a heap buffer overflow when parsing a maliciously crafted LYB binary blob. A remote attacker, by supplying this malicious LYB data to any libyang consumer (such as a NETCONF server), could trigger a crash, resulting in a denial of service (DoS), or potentially achieve arbitrary code execution through heap corruption.

This is an Important flaw in libyang, which could allow a remote attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability arises from an integer overflow when processing a specially crafted LYB binary blob, impacting Red Hat products that consume libyang data, such as NETCONF servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.