---
id: 3835
title: "strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication"
cve: CVE-2026-25075
cvss: 7.5
severity: high
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication"
published_at: "2026-03-26 00:00"
tags: ["vulnerability-research", "denial-of-service", "integer-underflow", "vpn", "strongswan", "cve-2026-25075", "eap-ttls"]
phying_url: "https://phying.com/item/3835"
lang: en
---

# strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication

## Summary

Bishop Fox exploited CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS plugin (4.5.0-6.0.4): crafted messages crash the IKE daemon via two-phase heap corruption; upgrade to 6.0.5+.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-25075
- **CVSS:** 7.5
- **Published:** 2026-03-26 00:00
- **Original:** https://bishopfox.com/blog/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication
- **Phying News:** https://phying.com/item/3835