An integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS permits a remote attacker, after completing an IKEv2 handshake, to crash the daemon by sending a specially crafted encrypted IKEv2 message, leading to a denial of service. The flaw is a classic integer underflow (CWE‑1284) triggered when the daemon processes message lengths, immediately affecting availability. The crash stops the IKE service, interrupting VPN connectivity for all users.

The vulnerability affects WatchGuard Fireware OS devices. All current releases are impacted until patched, with the vendor providing fixes through Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. Devices running these or earlier versions are susceptible, so any Fireware OS device that has not been updated to a fixed release must be considered at risk.

The CVSS score of 8.2 classifies the flaw as high severity, and the attack requires remote network access to an IKEv2 endpoint; the attacker must complete an IKEv2 handshake and then transmit a malformed encrypted message. Because the EPSS score is not available, the likelihood of exploitation in the wild cannot be precisely quantified, and the vulnerability is not listed in CISA KEV. Nevertheless, the combination of a high impact on service availability and the ability to trigger the crash from an external network makes it a significant threat for organizations relying on Fireware OS VPN services.