A heap‑based buffer overflow exists in the Fireware OS Active Directory authentication service. If an attacker can control or intercept the traffic sent to the configured AD server, the service may be forced into a denial‑of‑service state or may execute arbitrary code with the privileges of the service. The flaw arises from improper bounds checks, corresponding to CWE‑122, CWE‑131, and CWE‑787 weaknesses. The potential impact is full compromise of the affected device, allowing attacker‑controlled code to run on the system.

The vulnerability affects WatchGuard Fireware OS devices. The official CNA identifies the mitigateable versions as Fireware OS 2026.4, Fireware OS 12.12.4, and Fireware OS 12.5.22, implying earlier releases are vulnerable.

The CVSS score of 9.2 indicates a high‑severity flaw, and while the EPSS score is currently unavailable, the lack of a known exploit in the KEV catalog does not reduce the risk. The likely attack vector requires the attacker to control or tamper with traffic between the firewall and the AD server, which is feasible in environments where network segmentation is insufficient or where the attacker can perform a man‑in‑the‑middle attack.