Libevent versions prior to 2.1.13 and 2.2.2-a contain a vulnerability identified as CVE-2026-63381. The vulnerability affects multiple stable versions including those packaged in Ubuntu LTS releases from 14.04 through 26.04. According to the CVSS 4.0 vector, the attack requires local access with low complexity and partial privileges, does not require user interaction, and results in a medium impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no exploits are known to be active in the wild.

The vulnerability allows a local attacker with partial privileges to potentially impact the confidentiality, integrity, and availability of the system using libevent versions prior to 2.1.13 and 2.2.2-a. The attack complexity is low, but it requires local access and privileges. There is no indication of remote exploitation or user interaction needed. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor channels for updates and consider upgrading to libevent versions 2.1.13 or later, or 2.2.2-a or later, when available.