Null Pointer Dereference Vulnerability in Libreswan Authentication Process

CVE-2026-77207

What is CVE-2026-77207?

Libreswan contains a null pointer dereference vulnerability in its handling of PKCS#7 blobs during IKE certificate authentication. Specifically, an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509 is processed through two NSS APIs that provide conflicting results. While the SEC_PKCS7ContainsCertsOrCrls() function confirms the presence of a Certificate Revocation List (CRL), it fails to return certificates when the SEC_PKCS7GetCertificateList() function is called, resulting in a null pointer dereference. This vulnerability can be exploited with a crafted IKE_AUTH packet, allowing a malicious peer to trigger the bug without being authenticated, potentially leading to a service crash. While there is no risk of remote code execution, continued exploitation can lead to denial of service.

References