Libreswan CVE-2026-12413

Exploitation requires the target to accept IKEv2 connections where IKE fragmentation is not disabled - i.e., any connection configuration that does not set fragmentation=no; this is the exact prerequisite named in the advisory and covers typical default IKEv2 setups. The attacker needs network reachability to the IKE service (UDP 500/4500) but no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L). Limiting factors that reduce realistic exposure: IKEv1-only deployments are not vulnerable, connections explicitly configured with fragmentation=no are not vulnerable, and gateways whose IKE ports are firewalled to known peer IPs sharply narrow who can deliver the malformed fragment. Impact is confined to availability (daemon crash/restart) with no code execution or data exposure.

The signals are internally consistent for a genuine, easily triggered availability threat: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) reflects remote, low-complexity, unauthenticated exploitation with high availability impact and no confidentiality or integrity loss, matching the description of a crash-and-restart DoS with explicitly no RCE. EPSS was not provided in the input and KEV status is not listed, so there is no evidence of active exploitation - treat this as no public exploit identified at time of analysis rather than an in-the-wild threat. The 'RCE' tag in the intelligence conflicts directly with the description's statement 'No remote code execution is possible'; the description and CVSS (I:N) should be trusted over the tag, which appears to be a mislabel. Real priority is moderate-to-high for organizations exposing IKEv2 VPN endpoints to untrusted networks because the barrier to trigger is minimal, but the ceiling is limited to availability - no data compromise. SSVC-style framing: exploitation=none observed, automatable=yes (a single crafted packet, scriptable), technical impact=partial (service outage only).

An attacker on the network path to an internet-facing IPsec gateway sends a single invalidly formatted IKEv2 fragment containing unknown outer payloads to UDP 500/4500, triggering the off-by-one assertion and aborting the pluto daemon. Because the daemon restarts, the attacker simply resends the packet in a loop to keep the VPN service continuously unavailable. No authentication, credentials, or user interaction are needed, and no public proof-of-concept is referenced in the available data.