CVE-2026-78123
Received Received - Intake

Expired Pointer Dereference in strongSwan PKCS#7 Parsing

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-78123
EUVD
EUVD-2026-75898

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
strongswan strongswan From 5.0.2 (inc) to 6.0.7 (inc)
strongswan strongswan 6.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-825 The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in strongSwan versions 5.0.2 through 6.0.7 involves an expired pointer dereference in PKCS#7 parsing within the openssl plugin. When processing PKCS#7 containers, the plugin fails to initialize stack variables for signerInfo or recipientInfo structures. If these structures use issuerAndSerialNumber instead of subjectKeyIdentifier, uninitialized pointers are passed to OpenSSL functions, causing crashes due to undefined memory access.

Detection Guidance

Check if strongSwan versions 5.0.2 through 6.0.7 are installed and if the openssl plugin is loaded. Inspect logs for crashes during PKCS#7 parsing. Use commands like 'strongswan status' or 'ipsec status' to verify plugin status.

Impact Analysis

This vulnerability can cause service disruptions by crashing the strongSwan application when processing PKCS#7 or CMS containers with signed or encrypted data. While remote code execution is unlikely, the crashes may lead to denial-of-service conditions, affecting VPN services or other strongSwan-dependent systems.

Compliance Impact

This vulnerability causes crashes in strongSwan when processing PKCS#7/CMS containers, which could lead to service disruptions. Such disruptions may impact availability requirements under GDPR (Article 32) and HIPAA (Security Rule 164.308(a)(7)), potentially violating compliance if systems fail to maintain continuous protection or access to sensitive data.

Mitigation Strategies

Upgrade strongSwan to version 6.1.0 or later. If upgrading is not possible, avoid using IKEv1 connections or ensure the openssl plugin is not loaded. Apply patches for older releases if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart