Quick answers
- Is CVE-2026-78123 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78123 being exploited in the wild.
- How severe is CVE-2026-78123?
- Medium severity, with a CVSS score of 5.9, published 11 September 2026.
- Which products and versions are affected?
- strongSwan 5.0.2 through 6.0.7.
- Is there a fix for CVE-2026-78123?
- A patch was published on 2026-09-07: Fixed in strongSwan 6.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78123 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78123?
- Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The openssl plugin in strongSwan does not properly initialize stack variables when parsing PKCS#7 signerInfo or recipientInfo structures that use subjectKeyIdentifier encoding instead of issuerAndSerialNumber. When the OpenSSL library function CMS_SignerInfo_get0_signer_id() or CMS_RecipientInfo_ktri_get0_signer_id() encounters subjectKeyIdentifier format, it leaves uninitialized pointers unchanged despite returning success. Subsequent code dereferences these uninitialized pointers via openssl_x509_name2id() and openssl_asn1_str2chunk(), causing a segmentation fault. The vulnerability affects strongSwan 5.0.2 through 6.0.7 and is reachable via IKEv1 connections. Remote code execution is unlikely; the primary impact is denial of service through a crash.
Affected products
- strongSwan strongSwan 5.0.2 through 6.0.7
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in strongSwan 6.1.0