What is the CVSS score of CVE-2025-32787?

CVE-2025-32787 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of SoftEtherVPN are affected by CVE-2025-32787?

CVE-2025-32787 is a low-severity vulnerability in SoftEtherVPN involving null pointer dereference (CVSS 3.1).

How to fix or mitigate CVE-2025-32787?

During next maintenance window: Apply vendor patches when convenient. Verify null pointer dereference controls are in place.

SoftEtherVPN CVE-2025-32787

LOW

NULL Pointer Dereference (CWE-476)

2025-04-16 security-advisories@github.com

Null Pointer Dereference Denial Of Service

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:37 vuln.today

CVE Published

Apr 16, 2025 - 22:15 nvd

LOW 3.1

DescriptionGitHub Advisory

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL, resulting in the program crashing. A patched version does not exist at this time.

AnalysisAI

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL, resulting in the program crashing. A patched version does not exist at this time.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.