Libreswan's pluto daemon contains a use‑after‑free flaw that occurs when a client connected via IKE over TCP closes the connection and the daemon later receives a retransmit or malicious packet for the same communication tuple. The vulnerability causes the daemon to dereference an invalid pointer to a service endpoint that is no longer valid, leading to a crash and forced restart. The flaw can be triggered before the remote peer has authenticated, giving an attacker the potential to cause a denial of service, and the description notes that remote code execution could be possible. Based on the description, it is inferred that the flaw can be triggered before authentication and may enable remote code execution.

The issue affects the Libreswan Project’s libreswan implementation. All releases prior to libreswan 5.3.3 and 5.4.1 are vulnerable when the configuration includes the IKE-over-TCP option (listen-tcp=yes). Versions 5.3.3, 5.4.1, and later contain the patch that fixes the pointer misuse.

The CVSS score of 7.5 indicates high severity, although the EPSS score is less than 1 %, suggesting the likelihood of exploitation in the wild is currently low. The flaw is remote, requiring the attacker to have network access to a host running libreswan with IKE-over-TCP enabled. On triggering, the daemon will crash and restart, causing a denial of service; the vendor advisory even notes that remote code execution could be feasible. Because the vulnerability can be triggered before authentication, it does not depend on privileged credentials. The statement that the attack can be conducted before authentication and that remote code execution could be feasible is inferred from the description.