{"uuid": "780f7150-e459-4841-aac4-453d1f37c40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77207", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117440105727271162", "content": "CVE-2026-77207 Null Pointer Dereference in PKCS#7 bundle with no certificates Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77207https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txthttps://libreswan.org/security/CVE-2026-77207/#libreswan #TheLibreswanProject#CVE_2026_77207#bot", "creation_timestamp": "2026-10-14T16:03:21.307278Z"}