The vulnerability CVE-2026-44673 affects libyang, a YANG data modeling language library. Specifically, an integer overflow occurs in the lyb_read_string() function within src/parser_lyb.c when processing specially crafted LYB binary blobs. This integer overflow results in a heap buffer overflow, which can cause a crash or heap corruption. Remote attackers who can supply malicious LYB data to libyang consumers (e.g., NETCONF servers) may trigger denial of service or potentially arbitrary code execution. The issue is resolved in libyang version 5.2.15. Red Hat has issued security advisories and updates for affected products, including Red Hat Enterprise Linux 10, providing fixed libyang packages.

The integer overflow leads to a heap buffer overflow, which can cause a denial of service by crashing the affected application or potentially allow an attacker to execute arbitrary code via heap corruption. The vulnerability can be triggered remotely without authentication by supplying malicious LYB data to libyang consumers. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and high availability impact. There is no impact on confidentiality or integrity reported.

A fix is available in libyang version 5.2.15 and later. Red Hat has released updated libyang packages for Red Hat Enterprise Linux 10 and related products that address this vulnerability. Users should apply these official security updates promptly to remediate the issue. No effective mitigations meeting Red Hat's criteria are currently available other than upgrading to the fixed version. Monitoring or other generic mitigations are not specifically recommended by the vendor.