Fireware OS Stack

Psirt.Watchguard • September 30, 2026

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.

Weakness Type and Impact #

CWE CWE-121 Stack-based Buffer Overflow

CAPEC CAPEC-100 Overflow Buffers

Exploitation Status #

Nicholas Zubrisky (@NZubrisky) of TrendAI Research finder

View the canonical record on cve.org

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Stack-Based Buffer Overflow Vulnerabilities in WatchGuard Fireware OS Two stack-based buffer overflow vulnerabilities have been identified in WatchGuard Fireware OS. CVE-2026-81433 affects the DHCP fingerprinting daemon, allowing unauthenticated attackers with adjacent network access to execute arbitrary code or crash the process through specially crafted DHCP packets. CVE-2026-18145 impacts the spamBlocker service, permitting authenticated attackers with admin privileges to crash the service or execute arbitrary code via crafted management requests. Both vulnerabilities pose significant risks to users of WatchGuard Fireware OS. The vulnerabilities have been disclosed today, and further details are available on the CVE database. No patches have been mentioned in the articles, indicating that these vulnerabilities may still be. 1 sources 49

Extracted Entities

Fireware OS Stack

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Domains (1)

Platforms (1)

Vulnerabilities (1)