CVE-2025-62291: Strongswan

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.

Affected products

• Strongswan Strongswan: from 4.2.12, before 6.0.3 (fixed in 6.0.3)

Published 2026-01-16. Last modified 2026-06-17.