libyang: lyb_read_string() integer overflow → heap buffer overflow
Priority HIGH 72CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00635 50th percentileScored 2026-11-07
Fix Fixed Red Hat: 10 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Red Hat 10 advisories
- RHSA-2026:65508 Released 2026-09-08 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) libyang-2.1.148-1.el9_6.1
- RHSA-2026:65467 Released 2026-09-08 · Red Hat rating Importantlibyang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) libyang-2.1.148-1.el9_4.1
- RHSA-2026:65477 Released 2026-09-08 · Red Hat rating Importantlibyang security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) libyang-2.1.148-1.el9_2.1
Show 7 more Red Hat advisories
- RHSA-2026:51368 Released 2026-08-06 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) libyang-1.0.184-1.el8_6.1
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libyang-1.0.184-1.el8_6.1
- RHSA-2026:51351 Released 2026-08-06 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) libyang-1.0.184-1.el8_4.1
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libyang-1.0.184-1.el8_4.1
- RHSA-2026:51339 Released 2026-08-06 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) libyang-1.0.184-1.el8_8.1
- Red Hat Enterprise Linux AppStream TUS (v.8.8) libyang-1.0.184-1.el8_8.1
- RHSA-2026:49666 Released 2026-08-03 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) libyang-2.1.148-2.el10_0.1
- RHSA-2026:25051 Released 2026-06-10 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream (v. 9) libyang-2.1.148-1.el9_8.1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libyang-devel-2.1.148-1.el9_8.1, libyang-devel-doc-2.1.148-1.el9_8.1
- RHSA-2026:24758 Released 2026-06-09 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream (v. 10) libyang-2.1.148-4.el10_2
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libyang-devel-2.1.148-4.el10_2, libyang-devel-doc-2.1.148-4.el10_2
- RHSA-2026:24545 Released 2026-06-08 · Red Hat rating Importantlibyang security update
- Red Hat Enterprise Linux AppStream (v. 8) libyang-1.0.184-2.el8_10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:24758 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:24545 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:25051 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:51351 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:51368 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:51339 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:65477 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:65467 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:49666 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:65508 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:51351 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:51368 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:51339 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:24758 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:25051 |
Not affected: 9 products
- Red Hat Enterprise Linux AppStream AUS (v.8.4)
- Red Hat Enterprise Linux AppStream AUS (v.8.6)
- Red Hat Enterprise Linux AppStream E4S (v.8.8)
- Red Hat Enterprise Linux AppStream E4S (v.9.2)
- Red Hat Enterprise Linux AppStream E4S (v.9.4)
- Red Hat Enterprise Linux AppStream EUS (v.9.6)
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
- Red Hat Enterprise Linux AppStream TUS (v.8.8)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44673
More CESNET vulnerabilities
- TI-2023-11820 libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via… CVSS 3.1HIGH 7.5
- TI-2026-79264 Uninitialized pointer free in libyang NETCONF RPC parser CVSS 4.0MEDIUM 6.0
- TI-2019-13946 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
- TI-2019-13945 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
- TI-2019-11637 The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php. CVSS 3.0CRITICAL 9.8
- TI-2026-85169 Heap buffer overflow in CESNET ipfixcol2 TCP LZ4 decoder CVSS 4.0HIGH 8.7
Sources
- CVE-2026-44673 · CVE Program
- CVE-2026-44673 · NVD
- FIRST EPSS
- CVE-2026-44673 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences