{"id":"CVE-2026-77207","published":"2026-10-13T22:18:26.040","lastModified":"2026-10-16T19:55:59.740","description":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-252","CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://libreswan.org/security/CVE-2026-77207/","tags":[]},{"url":"https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}