Heap Buffer Overflow Vulnerability in libyang by CESNET

CVE-2026-44673

What is CVE-2026-44673?

The libyang library, utilized for YANG data modeling, is susceptible to a heap buffer overflow due to an integer overflow in the function lyb_read_string() before version SO 5.2.15. An attacker able to supply specially crafted LYB binary data to libyang consumers, such as NETCONF servers or sysrepo, may exploit this vulnerability to induce a crash or potentially corrupt heap memory. This issue can lead to system instability and unauthorized access if left unaddressed. The vulnerability has been remedied in version SO 5.2.15. For more information, visit the advisory at CESNET.

References