The libcharon component in strongSwan versions 6.0.0 through 6.0.7 contains a use-after-free vulnerability in the handling of IKEv2 rekeying collisions with multi-key exchange. This memory management flaw could be exploited by a remote attacker to execute arbitrary code. The issue specifically affects Ubuntu 26.04 LTS versions of strongSwan. The vulnerability is tracked as CVE-2026-78133 and has a CVSS 3.1 base score of 7.5, indicating a medium severity with high impact on confidentiality, integrity, and availability. Ubuntu has released patched package versions (6.0.4-1ubuntu3.2) to remediate this vulnerability.

Successful exploitation of this use-after-free vulnerability could allow a remote attacker to execute arbitrary code on affected systems, potentially compromising confidentiality, integrity, and availability of the VPN service. The CVSS score of 7.5 reflects significant impact, though exploitation requires network access and elevated privileges are limited to low. No known exploits are reported in the wild at this time.

A fix is available and should be applied by updating strongSwan to the patched versions provided by Ubuntu, specifically version 6.0.4-1ubuntu3.2 or later for Ubuntu 26.04 LTS. Standard system updates will apply the necessary patches. No additional mitigation actions are required beyond applying the official update.