Technical impact
The vulnerability is a stack‑based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS. An attacker who can authenticate with administrator privileges can send a specially crafted management request that overflows the stack, causing the service to crash or potentially execute arbitrary code. This flaw enables a privileged user to compromise the integrity and confidentiality of the device and disrupt the availability of the spamd service.
Affected Systems
WatchGuard Fireware OS devices are affected. The exact versions that are vulnerable are not specified in the advisory; however, the vendor recommends upgrading to one of the following releases—Fireware OS 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21—to remediate the issue.
Risk and Exploitability
The CVSS score of 8.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator account, implying that an attacker must first compromise credentials or gain privileged access. Once authenticated, the attacker can send malicious requests over the network to trigger the overflow. The impact includes remote code execution on the firewall, potentially leading to full device takeover and the ability to manipulate network traffic. The lack of a readily available exploitation metric suggests the likelihood is moderate to high in environments where administrators have network exposure to the spamd management interface.
