Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-35330. PoCs published by Lukas Johannes Moeller, JohannesLks.
AI-analyzed exploit summary This exploit demonstrates a heap buffer overflow in strongSwan's EAP-SIM/AKA plugin due to an integer underflow in the `parse_attributes` function when processing a crafted EAP-SIM message with a zero-length attribute. The PoC triggers a heap-buffer-overflow WRITE under ASan or a SIGSEGV in production environments.
Description
strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow
Exploits (2)
This exploit demonstrates a heap buffer overflow in strongSwan's EAP-SIM/AKA plugin due to an integer underflow in the `parse_attributes` function when processing a crafted EAP-SIM message with a zero-length attribute. The PoC triggers a heap-buffer-overflow WRITE under ASan or a SIGSEGV in production environments.
The repository contains a functional exploit PoC for CVE-2026-35330, demonstrating a heap buffer overflow in strongSwan's EAP-SIM/AKA attribute parser via an integer underflow. The PoC links against installed strongSwan libraries and triggers the vulnerability by crafting a malicious EAP-SIM payload with an AT_RAND attribute of length 0.