Quick answers
- Is CVE-2026-78133 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78133 being exploited in the wild.
- How severe is CVE-2026-78133?
- High severity, with a CVSS score of 7.5, published 11 September 2026.
- Which products and versions are affected?
- strongSwan 6.0.0 through 6.0.7.
- Is there a fix for CVE-2026-78133?
- A patch was published on 2026-09-07: Fixed in strongSwan 6.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78133 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78133?
- Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use-after-free in libcharon's IKEv2 multi-key-exchange (multi-KE) rekeying collision handling. When both peers simultaneously request rekeying of the same IKE or Child SA, libcharon maintains a reference from the active (initiating) task to the passive (responding) task to resolve the collision via nonce comparison. With multi-KE rekeys, if the passive task fails (e.g., due to a missing or invalid KE payload that an attacker can control) before completing, the task manager destroys it while the active task still holds a dangling pointer. When the collision is later resolved, the active task dereferences this freed memory for an indirect function call, potentially leading to RCE. The attacker must be authenticated to the VPN and successfully manipulate the multi-KE exchange timing and payloads. Versions 6.0.0 through 6.0.7 are affected; strongSwan 6.1.0 and patched versions of older releases fix this issue.
Affected products
- strongSwan strongSwan 6.0.0 through 6.0.7
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in strongSwan 6.1.0