ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-77207

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication.

Published Oct 13, 2026 · catalog updated Oct 13, 2026 · Libreswan has a null

Check if you run it

No confirmed exploitation is on record for CVE-2026-77207. EPSS is 0.34%. Act only if a listed version of Libreswan has a null is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Libreswan has a null).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Advisory link
Affected products
See sources for product scope

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-77207

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-77207. EPSS is 0.34%. Act only if a listed version of Libreswan has a null is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-252: Unchecked Return Value; CWE-476: NULL Pointer Dereference. EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · Catalog

    Detected

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificat

Sources

  • CVE.orgVulnerability recordCVE-2026-77207

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-77207

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-77207

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.