BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CVE-2026-77207

7.5 high SSVC exploitation: none Awaiting Analysis
NVD · CVE.org

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

Fix

Microsoft's update · Important

  • Release Notes — azl3 libreswan 4.15-3 on Azure Linux 3.0 · build 4.15-4

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-29.

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 2

  1. StatusReceived → Awaiting AnalysisNVD modified 2026-10-16 19:55
  2. First seenCVSS 7.5NVD modified 2026-10-13 22:18

Affected (CPE criteria) 0

NVD has not attached CPE configurations yet.

References 2