Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77207— Null Pointer Dereference in PKCS#7 bundle with no certificates

Quick assessment

Affected
The Libreswan Project libreswan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreSwan 在 IKE 证书认证的 PKCS#7 处理代码中存在空指针解引用漏洞。当 LibreSwan 解码类型为 CERT_PKCS7_WRAPPED_X509 的 IKE CERT 载荷时，会通过调用 SEC_PKCS7ContainsCertsOrCrls() 对 PKCS#7 数据进行防护检查，随后调用 SEC_PKCS7GetCertificateList() 遍历证书列表。然而，这两个 NSS API 在处理仅包含 CRL（证书吊销列表）而不包含证书的 SignedData 结构时存在不一致行

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77207

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Null Pointer Dereference in PKCS#7 bundle with no certificates
Source: CVE Program / CVE List V5
Vulnerability Description
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
The Libreswan Project libreswan 4.7 ~ 5.3.2 -

II. Public POCs for CVE-2026-77207

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77207

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77207 (2)

Same Patch Batch · The Libreswan Project · 2026-10-13 · 4 CVEs total

CVE-2026-94453 7.5 HIGH IKEv2 Use-After-Free bug when using IKE-over-TCP
CVE-2026-77206 7.5 HIGH IKEv2 pre-authentication Null Pointer Dereference in EAP code
CVE-2026-77205 3.7 LOW Denial of Service via sending bogus X.509 certificates

IV. Related Vulnerabilities

Same product: libreswan
Same vendor: The Libreswan Project
Same weakness: CWE-476

V. Comments for CVE-2026-77207

No comments yet

Leave a comment