The vulnerability is a stack-based buffer overflow in the Fireware OS logging service. An attacker who is close to the device and can impersonate or intercept traffic to the device’s configured log server can supply a specially crafted certificate that causes the logging service to overflow a buffer and execute arbitrary code with root privileges.

WatchGuard Fireware OS devices are vulnerable. Any release of Fireware OS prior to the fixes released in Fireware OS 2026.4, Fireware OS 12.12.4, or Fireware OS 12.5.22 is affected.

The CVSS score of 9.1 indicates high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a network‑adjacent attacker or one who can intercept logging traffic; the attack vector depends on the ability to send forged certificates to the logging service. Successful exploitation would grant full control of the device at root level, posing a catastrophic threat to any installation that forwards logs to external servers or is exposed to local network traffic.