strongSwan EAP-TTLS Integer Underflow NULL Dereference DoS (CVE-2026-25075)

Vulnerability Overview Vulnerability Name: CVE-2026-25075 Discoverer: Kazuma Matsumoto Affected Software: strongSwan (Open Source IPsec VPN Implementation) Vulnerability Type: Integer Underflow leading to NULL Pointer Dereference Severity: Service Crash (DoS) Duration of Existence: 2011 to 2026 (Approximately 15 years) Technical Details: The vulnerability is located in line 133 of the file . When processing AVPs (Attribute-Value Pairs) in the EAP-TTLS protocol, the logic for calculating payload length is flawed: 1. is declared as (unsigned 32-bit integer). 2. The code executes . 3. If the provided is less than 8 (e.g., 0-7), the result does not become negative due to unsigned integer arithmetic; instead, an underflow occurs, resulting in a large positive number (e.g., 4,294,967,288). 4. The code subsequently calls to attempt allocating this massive memory block. 5. On most systems, the memory allocation fails and returns . 6. The code does not check the return value of and directly uses the returned pointer to call for writing data. 7. This triggers a NULL pointer dereference, causing the process to crash. Impact Scope Affected Versions: strongSwan 6.0.4 and earlier. Trigger Conditions: Requires an attacker to be able to send specially crafted EAP-TTLS packets to the VPN gateway. Consequences: Causes the background daemon of strongSwan to crash. All active VPN sessions are terminated. Service unavailability (DoS). System Differences: On systems with memory overcommit enabled, may temporarily succeed, but subsequent writes will trigger the OOM Killer to terminate the process due to insufficient physical memory. On systems with memory overcommit disabled, directly returns , causing an immediate crash. Remediation Patch Version: Patch released in March 2026. Fix Measure: Added a check for before calculating to ensure it is greater than or equal to 8 ( ). Detection Tool: A non-destructive detection tool has been released to probe whether the server is vulnerable to this issue without actually causing a crash. POC/Exploit Code

Goal Reached Thanks to every supporter — we hit 100%!

strongSwan EAP-TTLS Integer Underflow NULL Dereference DoS (CVE-2026-25075)