The vulnerability is a use‑after‑free bug located in the libcharon component of strongSwan 6.0.0 through 6.0.7. The flaw manifests during IKEv2 rekeying when a rekey collision occurs. If exploited, an attacker could corrupt memory, potentially leading to arbitrary code execution or a denial of service. The immediate risk is the loss of confidentiality, integrity, or availability of the VPN connection.

The affected product is strongSwan, specifically the libcharon module. Versions 6.0.0 through 6.0.7 are susceptible. All installations of strongSwan within these releases should be evaluated for exposure.

The CVSS score of 7.5 reflects a high severity vulnerability. No EPSS score is available, but the lack of attribution to CISA KEV indicates no confirmed exploitable exploits are publicly known yet. Nevertheless, the flaw can be triggered over the network by manipulating IKEv2 traffic, implying a network‑level attack vector. Administrators should consider the risk high until a patch is applied.