CVE-2026-77207

Published: Ott 14, 2026 Last Modified: Ott 14, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: d42dc95b-23f1-4e06-9076-20753a0fb0df
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

252

Unchecked Return Value

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity
Potential Impacts:
Unexpected State Dos: Crash, Exit, Or Restart
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Low
View CWE Details
476

NULL Pointer Dereference

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Execute Unauthorized Code Or Commands Read Memory Modify Memory
Applicable Platforms
Languages: C, C++, Java, C#, Go
Likelihood of Exploit: Medium
View CWE Details
https://libreswan.org/security/CVE-2026-77207/
https://libreswan.org/security/CVE-2026-77207/
https://libreswan.org/security/CVE-2026-77207/CVE-2026-7720…
https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt