CVE-2025-32787: Softethervpn

Low severity, CVSS 3.1. EPSS: 0.4% chance of exploitation in the next 30 days.

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.

Affected products

• Softethervpn Softethervpn: from 5.02.5184, up to and including 5.02.5187

Published 2025-04-16. Last modified 2026-06-17.