A buffer overflow in the GlobalProtect app occurs during the handling of requests and responses exchanged between the VPN Portal and Gateway. This flaw can be exploited by an attacker who places themselves as a man‑in‑the‑middle to corrupt memory, disrupt system processes, and potentially execute arbitrary code with SYSTEM privileges. The vulnerability does not depend on local privilege escalation, making it useful to attackers who can intercept VPN traffic.

Palo Alto Networks GlobalProtect App is affected on Windows, macOS, Linux, Android, ChromeOS, and the UWP App on Windows. Affected versions span 6.0 through 6.3 on Windows, macOS, and Linux; 6.1 through 6.3 on Android and ChromeOS; and 6.3.3‑h9 or earlier on the UWP App. The iOS app is not impacted. The vendor recommends upgrading to the specified higher release for each platform (e.g., 6.3.3‑h9 or later on Windows, 6.3.3‑h2 or later on Linux).

The CVSS score of 5.2 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network‑based man‑in‑the‑middle that can inject or intercept packets between the client and the Portal/Gateway. Because the flaw can lead to SYSTEM‑privilege code execution, the potential impact is high if an attacker succeeds. The absence of a public workaround and the moderate exploitability emphasize the need to apply the vendor‑supplied patches promptly.