An integer underflow in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite. The flaw is a classic integer underflow (CWE‑191) that occurs before authentication, resulting in the daemon terminating and rendering the VPN service unavailable. This impact is limited to availability; it does not expose confidential data or alter system integrity.

The vulnerability affects all WatchGuard Fireware OS devices running versions that do not include the published fixes. The identified patched releases are Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, and Fireware OS 12.5.21; any earlier releases are considered vulnerable.

With a CVSS score of 8.2, the flaw is high severity. The EPSS score is not available, but the lack of KEV listing and no publicly identified exploits suggest a moderate likelihood of real‑world attacks. The attack vector is remote; an adversary only needs to send a crafted IKEv2 packet using AES‑GCM to trigger the crash, which can be achieved from an untrusted network without authentication.