The libyang library, used for YANG data modeling, contains an integer overflow in the lyb_read_string() function in versions prior to 5.2.15. This overflow leads to a heap buffer overflow when parsing specially crafted LYB binary data. An attacker able to supply LYB data to any libyang consumer can trigger a denial of service or potentially cause heap corruption. The vulnerability is addressed by an official patch in libyang 5.2.15. Red Hat has issued security advisories and updates for affected Red Hat Enterprise Linux 10 variants to remediate this issue.

Exploitation of this vulnerability can cause a denial of service via application crash or potentially lead to heap corruption, which might be leveraged for arbitrary code execution. The CVSS score of 7.5 reflects a high severity with network attack vector, no privileges required, and no user interaction needed. There is no confirmed evidence of exploits in the wild at this time.

An official fix is available in libyang version 5.2.15. Users and administrators should apply the security updates provided by their vendors, such as the Red Hat Enterprise Linux 10 updates referenced in the Red Hat advisories RHSA-2026:24545 and RHSA-2026:24758. No additional mitigation is required beyond applying these patches.