EUVD-2026-54645
GHSA-q437-rgxw-hhjh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local driver interaction requires an active local session (AV:L, PR:L); no scope change, no confidentiality or integrity loss - only kernel crash availability impact.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
3DescriptionCVE.org
SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.
AnalysisAI
Out-of-bounds kernel memory read in SonicWall Global VPN Client's SWIPsec.sys driver allows a local, low-privileged attacker to crash the host system. Affected versions are 4.10.8.1108 and earlier, running on Windows where the IPsec kernel driver is loaded by the VPN client. No public exploit identified at time of analysis, and EPSS probability stands at a very low 0.16% (5th percentile), indicating no signs of active or widespread exploitation interest.
Technical ContextAI
The vulnerable component is SWIPsec.sys, a Windows kernel-mode driver that handles IPsec tunnel processing for the SonicWall Global VPN Client. CWE-125 (Out-of-bounds Read) identifies the root cause: the driver reads beyond the bounds of an allocated memory buffer in kernel space. Because kernel-mode code runs with elevated privilege and without the memory isolation protections of user-space, an invalid memory access at this level results in a Windows kernel panic (BSOD) rather than a recoverable exception. The affected CPE is SonicWall Global VPN Client up to and including version 4.10.8.1108. The vulnerability was reported directly by SonicWall's own PSIRT (PSIRT@sonicwall.com) and assigned ENISA EUVD-2026-54645 in parallel.
RemediationAI
Consult the SonicWall PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0010 for the vendor-released patch; no specific fixed version number was included in the available intelligence data, so the exact remediated version must be confirmed from that source before upgrading. As a compensating control where immediate upgrade is not feasible, restricting local interactive or remote desktop logon rights to only trusted administrative accounts on hosts running the SonicWall Global VPN Client will raise the bar for exploitation, since the attack requires a local low-privilege session. Disabling or uninstalling the Global VPN Client on endpoints that do not actively require site-to-site VPN connectivity eliminates the attack surface entirely but disrupts legitimate VPN usage. NVD details are also available at https://nvd.nist.gov/vuln/detail/CVE-2026-66151.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
SonicWall SonicOS SSLVPN contains an authentication bypass vulnerability allowing remote attackers to bypass authenticat
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Rated h
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account
SonicWall SMA1000 AMC and CMC contain a pre-authentication deserialization vulnerability allowing unauthenticated remote
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attacke
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today