CVE-2025-62291

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel.

Security Fix(es):

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.(CVE-2025-62291)

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel.

Security Fix(es):

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.(CVE-2025-62291)

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow.

Buffer Overflow When Handling EAP-MSCHAPv2 Failure Requests. (CVE-2025-62291)

These are all security issues fixed in the strongswan-6.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for strongswan fixes the following issues:

• CVE-2025-62291: Fixed buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941).

This update for strongswan fixes the following issues:

• CVE-2025-62291: Fixed buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941).

This update for strongswan fixes the following issues:

• CVE-2025-62291: fixed buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941)

This update for strongswan fixes the following issues:

• CVE-2025-62291: fixed buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941)

This update for strongswan fixes the following issues:

• CVE-2025-62291: fixed a buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941)

This update for strongswan fixes the following issues:

• CVE-2025-62291: fixed buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941)

This update for strongswan fixes the following issues:

• CVE-2025-62291: fixed a buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941)

This update for strongswan fixes the following issues:

• CVE-2025-62291: fixed buffer overflow when handling EAP-MSCHAPv2 failure requests (bsc#1251941)

Xu Biang discovered that the strongSwan client incorrectly handled EAP-MSCHAPv2 failure requests. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code.