Null Pointer Dereference in PKCS#7 bundle with no certificates
Summary
| CVE | CVE-2026-77207 |
|---|---|
| State | PUBLISHED |
| Assigner | libreswan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-13 22:18:26 UTC |
| Updated | 2026-10-16 19:55:59 UTC |
| Description | Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from d42dc95b-23f1-4e06-9076-20753a0fb0df
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003390000 probability, percentile 0.257430000 (date 2026-10-16)
Problem Types: CWE-252 | CWE-476 | CWE-476 CWE-476: Null Pointer Dereference | CWE-252 CWE-252: Unchecked Return Value
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | d42dc95b-23f1-4e06-9076-20753a0fb0df | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Libreswan Project | Libreswan | affected 4.7 5.3.2 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | affected 5.4 5.4 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.3.3 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.4.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | |
| libreswan.org/security/CVE-2026-77207 | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Claude (Anthropic) (en)
CNA: David Korczynski (ADA Logics Ltd) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-05T00:00:00.000Z | Libreswan was notified of the issue via [email protected] |
| CNA | 2026-09-24T00:00:00.000Z | Advanced notice given to supported customers and distributions |
| CNA | 2026-10-05T00:00:00.000Z | Public announcement and release of libreswan 5.3.3 and 5.4.1 |
Solutions
CNA: Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/
Workarounds
CNA: Apply the available patch or upgrade to a supported version. No configuration-based workaround is available.
Exploits
CNA: No known exploitation in the wild. Exploitation requires sending a malicious IKE CERT payload with a PKCS#7 SignedData containing a CRL but no certificates, and does not require peer authentication.