Log in / Sign up

Vulnerability details

CVE-2026-77207

The Libreswan Project libreswan

Null Pointer Dereference in PKCS#7 bundle with no certificates

CVSS 3.1
7.5High

Official description

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CVEProject cvelistV5 (CNA) (libreswan) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersionsSource
The Libreswan Project libreswan 4.7 ≤ v ≤ 5.3.2 CVEProject cvelistV5 (CNA)
The Libreswan Project libreswan 5.4 ≤ v ≤ 5.4 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-10-14
Last updated
2026-10-16
State
Published
Assigner (CNA)
libreswan

Exploit prediction (EPSS)

0.46%
Probability of exploitation in 30 days
40.3%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-476
    Null Pointer Dereference
  • CWE-252
    Unchecked Return Value