CVE-2026-19318
Received
Received - Intake
Stack-Based Buffer Overflow in WatchGuard Fireware OS
Vulnerability report for CVE-2026-19318, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-28
Last updated on: 2026-08-28
Assigner: WatchGuard Technologies, Inc.
Description
Description
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| watchguard | fireware_os | From 2025.0 (inc) to 2026.2.2 (exc) |
| watchguard | fireware_os | From 12.0 (inc) to 12.12.2 (exc) |
| watchguard | fireware_os | 12.5.* |
| watchguard | fireware_os | 12.12.2 |
| watchguard | fireware_os | 2026.2.2 |
| watchguard | fireware_os | 12.5.20 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
