CVE-2026-78009: CWE-125 in WatchGuard Fireware OS

This vulnerability (CVE-2026-78009) involves an out-of-bounds read (CWE-125) in the iked process of WatchGuard Fireware OS. Exploitation requires no authentication and can be triggered remotely by sending crafted network packets, resulting in a denial of service affecting VPN functionality. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality but no impact on integrity or availability beyond the DoS condition. The affected product is WatchGuard Fireware OS, with affected versions explicitly including =2025.0, =12.0, and 2026.3. The vendor has not provided a remediation level or patch information as of the publication date.

Successful exploitation leads to a denial of service condition in VPN processing on affected WatchGuard Fireware OS devices. This can disrupt VPN connectivity and potentially impact network availability for users relying on the VPN service. There is no indication of privilege escalation, data integrity compromise, or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, organizations should monitor WatchGuard's advisories for updates. Until a fix is available, consider limiting exposure of the VPN service to untrusted networks if feasible.