A stack-based buffer overflow exists in the certd process of WatchGuard Fireware OS. When an attacker sends a crafted request to the certificate management service, the overflow can crash the service and, due to the nature of stack corruption, may allow arbitrary code execution on the system.

WatchGuard Fireware OS devices running versions 12.5.22, 12.12.4, or 2026.4 are affected. The vulnerability is limited to the certd service component within these operating system releases.

The vulnerability scores a CVSS of 8.6, indicating high severity, and has no EPSS data or KEV listing at present. Attack requires authentication to the Firebox management interface, implying an attacker already has legitimate access to the device’s configuration portal. Once authenticated, the attacker can trigger the crash and potentially execute code, exposing the device to denial of service and elevated compromise risk.