strongSwan CVE-2026-78133

Requires an authenticated IKE peer: exploitation is limited to parties that have already completed IKE authentication and hold an active IKE SA (CVSS PR:L). The Multi-KE (RFC 9370 Multiple Key Exchange) extension must be enabled and negotiated on the strongSwan instance - deployments using only conventional IKEv2 key exchange are not affected. A rekey collision must be induced: both the attacker-controlled peer and the strongSwan endpoint must simultaneously initiate a Multi-KE rekey, which requires either deliberate timing by the attacker or exploitation of a natural race window (CVSS AC:H). Unauthenticated external attackers with no prior IKE SA cannot trigger this vulnerability directly.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.5 and accurately characterizes the threat: network-reachable but requiring high attack complexity (deliberate or opportunistic rekey collision timing) and a low-privilege authenticated IKE peer. The AC:H and PR:L constraints meaningfully reduce practical exploitability relative to the full C:H/I:H/A:H impact metrics. No EPSS data was provided; given the multi-step timing requirement, opportunistic exploitation is unlikely. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. Real-world risk is primarily elevated for deployments that have explicitly enabled RFC 9370 Multi-KE (post-quantum hybrid key exchange), as the vulnerable code path is not reached in standard IKEv2 configurations. Ubuntu's reporting role suggests downstream distribution packages will receive patched builds. CVSS severity is proportionate given the potential for RCE in the IKE daemon, but the AC:H/PR:L barrier keeps practical risk moderate rather than critical.

An attacker controlling a remote IKE peer with a valid established IKE SA configures their client to initiate a Multi-KE rekey at a moment that collides with an in-progress or simultaneously triggered rekey from the strongSwan responder side. The resulting race condition frees a Multi-KE state object while the other codepath still holds a reference, and the attacker subsequently triggers a dereference of the freed memory. If heap layout can be influenced - typical of authenticated VPN session context - this may escalate to arbitrary code execution within the charon IKE daemon, potentially compromising the VPN gateway host.