CVE-2025-62291
High · 8.1CVSS
8.1
EPSS
1.0%
Published
Jan 16, 2026
CISA due date
—
The record
In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | strongswan | 0 | 5.9.12-150600.3.5.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | strongswan | 0 | 5.9.14-150700.3.3.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | strongswan | 0 | 5.9.12-150600.3.5.2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | strongswan | 0 | 5.9.14-150700.3.3.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | strongswan | 0 | 5.9.12-150600.3.5.2 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | strongswan | 0 | 5.9.14-150700.3.3.1 |
| openSUSE:Leap 15.6 | strongswan | 0 | 5.9.12-150600.3.5.2 |
| openSUSE:Leap 16.0 | strongswan | 0 | 6.0.1-160000.3.1 |
| openSUSE:Tumbleweed | strongswan | 0 | 6.0.3-1.1 |
Related vulnerabilities
- CVE-2026-25075 strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in… Also affects strongswan
- CVE-2025-9615 A flaw was found in NetworkManager. Also affects strongswan
- CVE-2017-11185 The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of… Also affects strongswan
- CVE-2017-9022 The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys… Also affects strongswan
- CVE-2015-8023 The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in… Also affects strongswan
- CVE-2015-4171 strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when… Also affects strongswan
- CVE-2014-9221 strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of… Also affects strongswan
- CVE-2026-88833 A flaw was found in BusyBox's udhcpc DHCP client. CWE-191