CVE-2020-13132: Yubico Libykpiv

Medium severity, CVSS 4.6. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_generate_key() function in lib/util.c through incorrect error handling code. This could be used to cause a denial of service attack.

Affected products

• Yubico Libykpiv: before 2.1.0 (fixed in 2.1.0)
• Yubico Piv Tool Manager: before 2.0.0 (fixed in 2.0.0)
• Yubico Yubikey Smart Card Minidriver: up to and including 4.1.0.172

Published 2020-07-09. Last modified 2026-06-17.