A NULL pointer dereference is present in libyang before v1.0-r3 in the function lysextensioninstancesfree() due to a copy of unresolved extensions in lysrestrdup(). Applications that use libyang to parse untrusted input yang files may crash.

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.