CVE-2025-32787CWE-476

SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA

Low · published April 16, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6DefaultRouterInRA` called by `StorePacket`. Before dereferencing, `DeleteIPv6DefaultRouterInRA` does not account for `ParsePacket` returning NULL, resulting in the program crashing. A patched version does not exist at this time.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-04-16T21:41Z
EPSS history
Timeline
  • 16 APR 21:41Z
    SoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRA
    cvelistv5