{"id":"CVE-2025-32787","aliases":["EUVD-2025-11791","GHSA-xw53-587j-mqh6"],"status":"published","title":"SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA","description":"SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00406,"percentile":0.35177,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2025-04-16T21:41:15Z","modified":"2026-10-28T02:31:09Z","products":[{"vendor":"softethervpn","product":"softethervpn"}],"references":[{"url":"https://github.com/SoftEtherVPN/SoftEtherVPN/security/advisories/GHSA-xw53-587j-mqh6","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/SoftEtherVPN/SoftEtherVPN/blob/7006539732c0231d7723623cc8732f94ba2b8c54/src/Cedar/Hub.c#L5112C1-L5116C29","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/SoftEtherVPN/SoftEtherVPN/blob/master/src/Mayaqua/TcpIp.c#L1633","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32787.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32787","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-32787","title":"SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA","description":"SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.","status":"published","published":"2025-04-16T21:41:15.966Z","modified":"2025-04-17T13:15:18.899Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-11791","description":"SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.","status":"published","published":"2025-04-16T21:41:15Z","modified":"2025-04-17T13:15:18Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:52:22.025137Z"}],"nvd":[{"id":"CVE-2025-32787","description":"SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.","status":"published","published":"2025-04-16T22:15:14.667Z","modified":"2026-06-17T09:12:34.333Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:11:00.810682Z"}],"osv":[{"id":"CVE-2025-32787","title":"SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA","description":"SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.","status":"published","published":"2025-04-16T21:41:15.966Z","modified":"2026-10-28T02:31:09.479471191Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:48.02508Z"}]}}