Michalvasko

**Name of the Vulnerable Software and Affected Versions** libyang versions prior to 1.0-r5 **Description** A stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". This issue may allow an attacker to cause a denial of service or possibly gain code execution. The vulnerability is related to a buffer overflow in memory, which can be exploited by a remote attacker. **Recommendations** For versions prior to 1.0-r5, update to version 1.0-r5 or later to resolve the issue. As a temporary workaround, consider restricting the use of libyang to parse untrusted YANG files until a patch is available. Avoid using libyang to parse YANG files with a leaf of type "bits" from untrusted sources.