Is CVE-2026-77207 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77207 being exploited in the wild.

How severe is CVE-2026-77207?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Libreswan 5.3, 5.4 and possibly others.

Is there a fix for CVE-2026-77207?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77207 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77207?

Check whether you run Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77207: Libreswan null pointer dereference in PKCS#7 handling

CVE-2026-77207 · Severity: high · CVSS 7.5 · Published 2026-10-13

Libreswan is an open-source IPsec VPN implementation used to establish secure site-to-site connections. A null pointer crash occurs when processing malformed IKE certificate payloads, allowing an unauthenticated attacker to repeatedly crash the VPN daemon and deny service. No data exposure or remote code execution is possible.

Technologies: Libreswan. Vendors: Libreswan.

Quick answers

Is CVE-2026-77207 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77207 being exploited in the wild.
How severe is CVE-2026-77207?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Libreswan 5.3, 5.4 and possibly others.
Is there a fix for CVE-2026-77207?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77207 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77207?: Check whether you run Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A null pointer dereference occurs in the PKCS#7 certificate handling code during IKE authentication. The vulnerability arises from a mismatch between two NSS library calls: SEC_PKCS7ContainsCertsOrCrls() returns true for a SignedData containing only a CRL, but SEC_PKCS7GetCertificateList() returns NULL for the same data. An attacker can send a crafted IKE_AUTH packet with such a payload to trigger the crash; no prior authentication or user interaction is required. The impact is denial of service through repeated crashes.

Affected products

Libreswan Libreswan 5.3, 5.4 and possibly others

Timeline

2026-10-13: disclosed
2026-10-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.