CVE-2026-94453

Published: Ott 14, 2026 Last Modified: Ott 14, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: d42dc95b-23f1-4e06-9076-20753a0fb0df
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

416

Use After Free

Stable
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Confidentiality
Potential Impacts:
Modify Memory Dos: Crash, Exit, Or Restart Read Memory Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: Memory-Unsafe, C, C++
Likelihood of Exploit: High
View CWE Details
https://libreswan.org/security/CVE-2026-94453/
https://libreswan.org/security/CVE-2026-94453/
https://libreswan.org/security/CVE-2026-94453/CVE-2026-9445…
https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt