CVE-2025-62291: In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.
Overview
- Severity
- High (CVSS 8.1)
- CVSS Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Exploit Status
- Not Exploited
- Patch Tuesday
- 2026-Jan
- Released
- 2026-01-18
- Last Updated
- 2026-02-18
- EPSS Score
- 0.01% (percentile: 2.7%)
Affected Products (4)
Other
- 20818-17084
- 18241-17086
- 20896-17084
- 20897-17086
Revision History
- 2026-01-18: Information published.
- 2026-01-19: Information published.
- 2026-01-21: Information published.
- 2026-02-18: Information published.