CVE-2026-77207

Received Received - Intake

Null Pointer Dereference in Libreswan PKCS#7 Handling

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Libreswan Project

Description

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77207

EUVD

EUVD-2026-100749

Affected Vendors & Products

Vendor	Product	Version / Range
The	Libreswan	Project libreswan 4.7
The	Libreswan	Project libreswan 5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

Libreswan has a null pointer dereference bug in PKCS#7 handling for IKE certificate authentication. When processing a CERT_PKCS7_WRAPPED_X509 payload, it checks for certificates or CRLs but then fails when only a CRL is present. This causes a crash and restart due to dereferencing a null pointer. A malicious IKE_AUTH packet can trigger this without authentication.

Impact Analysis

This vulnerability can cause denial of service by crashing and restarting Libreswan. It does not allow remote code execution but can disrupt VPN services. Exploitation requires a malicious packet, but no authentication is needed from the attacker.

Mitigation Strategies

Update Libreswan to the latest version that fixes the null pointer dereference bug in PKCS#7 handling for IKE certificate authentication. Monitor network traffic for malformed IKE_AUTH packets that may trigger the vulnerability.

Hi! I’m here to help you understand CVE-2026-77207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70