The libyang library, used for YANG data modeling, contains an integer overflow in the lyb_read_string() function in src/parser_lyb.c in versions before 5.2.15. This overflow results in a heap buffer overflow when parsing specially crafted LYB binary data. An attacker able to supply LYB data to any libyang consumer can trigger a denial of service or potentially cause heap corruption. The issue is tracked as CVE-2026-44673 with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Red Hat has issued security advisories and updates addressing this vulnerability, fixing it in libyang version 5.2.15.

Exploitation of this vulnerability can lead to denial of service via application crashes or potential heap corruption, which may be leveraged for arbitrary code execution. The vulnerability affects any software that consumes LYB data through libyang, including NETCONF servers and sysrepo. The CVSS score of 7.5 indicates a high impact on availability with no direct confidentiality or integrity loss reported.

A fix is available in libyang version 5.2.15. Users and administrators should upgrade to version 5.2.15 or later to remediate this vulnerability. Red Hat has released updated packages for Red Hat Enterprise Linux 10 and related distributions that include this fix. Refer to the Red Hat advisories (RHSA-2026:24758 and others) for detailed update instructions. No additional mitigations are required once the update is applied.