A stack-based buffer overflow occurs in WatchGuard Fireware OS’s DHCP fingerprinting daemon (fingerd), allowing an unauthenticated attacker with access to the same local network to send a specially crafted DHCP packet and trigger arbitrary code execution or service crash. The vulnerability is a classic input handling error, falling under analog input validation and memory corruption weaknesses. As a result, an attacker could gain control of the fingerd process or cause a denial of service, potentially compromising the integrity and availability of the gateway device.

WatchGuard Fireware OS is affected, with the advisory covering all versions prior to the released patches Fireware OS 2026.3.2, Fireware OS 2026.2.3, and Fireware OS 12.12.3. Any device running an earlier version of Fireware OS, especially those exposed to external DHCP traffic, is presumably vulnerable.

The vulnerability carries a high CVSS score of 8.7, indicating significant impact if exploited. Although the EPSS score is not available, the lack of an available metric does not diminish the baseline risk; the issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely observed as a known exploit. The attack vector is network-facing, requiring the attacker to be on an adjacent network to inject malicious DHCP messages. An unauthenticated attacker can exploit the flaw without any user interaction, making it a serious threat for networks that expose the gateway to external DHCP traffic.