A stack-based buffer overflow is triggered while parsing WireGuard configuration payloads in Fireware OS. When a malware‑laden configuration is processed, the vulnerability can cause a denial of service and, under certain conditions, allow arbitrary code execution. The weakness is a classic stack overflow, matched to CWE‑121, CWE‑787, and CWE‑1284, evidencing poor bounds checking during configuration parsing.

WatchGuard Fireware OS devices running versions earlier than Fireware OS 2026.4 or Fireware OS 12.12.4 are affected. The vulnerability specifically impacts the WireGuard configuration handling component of the Firebox firmware that communicates with WatchGuard Cloud through TLS connections.

The CVSS score of 9.5 classifies this as Critical, reflecting the full range of confidentiality, integrity, and availability damage that an exploited stack overflow can achieve. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploit yet. Attackers would need man‑in‑the‑middle TLS‑decrypted access between the Firebox and WatchGuard Cloud, a circumstance typically limited to insiders or attackers who have compromised the TLS channel. While the exploitation requires a specific attack vector, the potential impact remains high, warranting prompt remediation.