CVE-2025-32787

Summary

CVE-2025-32787 is a newly identified vulnerability affecting SoftEtherVPN versions 5.02.5184 to 5.02.5187. This open-source VPN program is susceptible to a NULL dereference issue. The problem lies in the function `DeleteIPv6DefaultRouterInRA`, which is called by `StorePacket`. The vulnerability arises when this function attempts to dereference a null pointer, which occurs when `ParsePacket` returns NULL without proper checking. Consequently, the program crashes. At present, a patched version of SoftEtherVPN is unavailable to address this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.