In strongSwan versions prior to 6.0.7, there is a double-free vulnerability caused by mishandling of identity parsing and cloning. When EAP-Identities are parsed and result in an empty but non-NULL encoding, the cloning process does not correctly duplicate these identities. This leads to a double-free condition when the duplicated identities are destroyed, which is classified as CWE-415 (Double Free). The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to memory corruption, potentially allowing an attacker to cause denial of service or execute arbitrary code, thereby compromising confidentiality, integrity, and availability of the affected system.

A fix is available in strongSwan version 6.0.7. Users should upgrade to version 6.0.7 or later to remediate this vulnerability. No vendor advisory patch links were provided, so users should consult the official strongSwan or SUSE Product Security Team advisories for the official patch and update instructions.