The vulnerability exists in the lyb_read_string() function of libyang before version 5.2.15, where an integer overflow (CWE-190) occurs during parsing of LYB binary blobs. This overflow results in a heap buffer overflow, potentially causing application crashes or heap corruption. An attacker able to supply crafted LYB data to any libyang consumer (such as NETCONF servers or sysrepo) can trigger this condition. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability but not confidentiality or integrity. The issue is resolved in libyang 5.2.15.

Exploitation of this vulnerability can cause denial of service through application crashes or heap corruption in software components that use libyang to parse LYB data. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

This vulnerability is fixed in libyang version 5.2.15. Users and administrators should upgrade to version 5.2.15 or later to remediate this issue. Since this is a library vulnerability, all dependent applications should be updated accordingly. Patch status is confirmed by the vendor's versioning information.