CVE-2026-112709: Heap Buffer Overflow in WatchGuard Fireware OS Authentication Service Enables DoS and Potential RCE via Crafted Active Directory Response

Summary

CVE-2026-112709 is a critical heap-based buffer overflow (CWE-122) in the authentication service of WatchGuard Fireware OS. An attacker who controls or intercepts traffic to the appliance’s configured Active Directory server can deliver a specially crafted response that triggers a denial of service condition and potentially executes arbitrary code. CVSS v4.0 scores the vulnerability 9.2 (CRITICAL).

Technical Analysis

The vulnerable component is the authentication service of WatchGuard’s Fireware OS. Per the published description, this service communicates with a configured Active Directory server, and the flaw triggers when the service processes a reply from that server: a specially crafted response overflows a heap buffer (CWE-122). The exact parsing routine, message format, and overflow offset are not fully disclosed.

Heap-based buffer overflows occur when data written into a heap allocation exceeds its bounds and corrupts adjacent memory. Both classic outcomes of this bug class appear in the description. First, corrupted heap memory can crash the authentication service, matching the stated denial of service condition. Second, if an attacker shapes the overflow precisely enough, the corruption can redirect execution — which is why the description says arbitrary code execution is ‘potentially’ possible. The available data does not confirm reliable code execution, and no exploit details are provided.

The CVSS v4.0 vector clarifies the preconditions. AV:N and AC:L mark the attack as network-based with low complexity, while AT:P (attack requirements: present) captures the key constraint: the attacker must already hold a position that allows controlling or intercepting traffic to the configured Active Directory server. That position is the gating factor — once it exists, PR:N and UI:N show that no privileges or user interaction are needed to trigger the flaw. The impact metrics VC:H, VI:H, and VA:H rate confidentiality, integrity, and availability impact on the vulnerable system as high, while SC:N, SI:N, and SA:N indicate no additional impact on subsequent systems.

In practical terms, the flaw inverts the usual trust model of an authentication flow. The Fireware OS appliance acts as the client: it sends authentication traffic to its trusted Active Directory server and consumes the reply. The vulnerability means that reply is a trust boundary the authentication service does not enforce safely, so whoever sits on that network path — or controls the AD server itself — effectively feeds input to a memory-unsafe code path inside the appliance’s authentication service.

Affected Software and Versions

The affected product is WatchGuard Fireware OS; the vulnerable component is its authentication service. Specific affected and fixed version numbers are not fully disclosed in the available data. Consult the WatchGuard PSIRT advisory for version scope and update guidance.

Impact

Denial of service: a crafted Active Directory response can crash the authentication service, creating a denial of service condition.
Potential arbitrary code execution on the Fireware OS appliance, as stated in the description.
High confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), scored 9.2 CRITICAL.
No privileges or user interaction required once the attacker controls or intercepts traffic to the configured Active Directory server.

Exploitation Scenario

The following scenario is illustrative and derived strictly from the published description; it is not a confirmed exploit chain.

The attacker obtains a position from which they can control or intercept traffic between the Fireware OS appliance and its configured Active Directory server — for example, by compromising a host on that network path or by taking control of the AD server itself.
The appliance initiates authentication traffic toward the Active Directory server.
Instead of a legitimate reply, the attacker returns a specially crafted response shaped to overflow a heap buffer in the authentication service.
The service processes the response; the crafted content writes past the bounds of a heap allocation.
The immediate outcome is a denial of service condition if the corruption crashes the service; with sufficient control over the overflow, the description states arbitrary code execution is potentially achievable.

Detection and Mitigation

Track the WatchGuard PSIRT advisory for CVE-2026-112709 and apply vendor updates as published; fixed versions are not listed in the available data.
Reduce exposure of the network path to the Active Directory server: restrict which hosts can route that traffic and harden the AD server itself, since control of that path is the exploitation precondition.
The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog per the available data.

Bug Bounty Angle

For researchers operating under authorized scope, the AT:P precondition defines the lab setup: stand up an appliance that authenticates against an Active Directory endpoint you fully control, then exercise the response handling of the authentication service with malformed replies. Boundary-checking of server responses in the authentication service is the review target. Because the flaw requires an in-path or controlling position, reproduction depends on a controlled interception or rogue-server lab rather than a one-shot remote request.

Discovery and Credits: Discovered by WatchGuard AI Security Research; the CVE was assigned by WatchGuard.

Frequently Asked Questions

What is CVE-2026-112709?

A critical heap-based buffer overflow (CWE-122) in the WatchGuard Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server triggers it with a crafted response, causing denial of service and potentially arbitrary code execution. CVSS v4.0 score: 9.2.

How is CVE-2026-112709 exploited?

The attacker must first control or intercept traffic between the appliance and its configured Active Directory server, then return a specially crafted response to the authentication service. No privileges or user interaction are required; the crafted response overflows a heap buffer, causing a denial of service and potentially code execution.