Low severity3.1OSV Advisory· Published Apr 16, 2025· Updated Apr 15, 2026

CVE-2025-32787

Description

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in DeleteIPv6DefaultRouterInRA called by StorePacket. Before dereferencing, DeleteIPv6DefaultRouterInRA does not account for ParsePacket returning NULL, resulting in the program crashing. A patched version does not exist at this time.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Softethervpn/SoftethervpnOSV2 versions
5.02.5184, 5.02.5185, 5.02.5186, …+ 1 more
- (no CPE)range: 5.02.5184, 5.02.5185, 5.02.5186, …
- (no CPE)range: 5.02.5184 to 5.02.5187

Patches

Vulnerability mechanics

References

github.com/SoftEtherVPN/SoftEtherVPN/blob/7006539732c0231d7723623cc8732f94ba2b8c54/src/Cedar/Hub.cnvd
github.com/SoftEtherVPN/SoftEtherVPN/blob/master/src/Mayaqua/TcpIp.cnvd
github.com/SoftEtherVPN/SoftEtherVPN/security/advisories/GHSA-xw53-587j-mqh6nvd

News mentions

No linked articles in our index yet.

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000