WatchGuard Fireware OS EUVD-2026-111156

Exploitation requires that the Firebox configuration include a policy that uses the SIP proxy (SIP Application Layer Gateway); the crafted request must be routed through that SIP-proxy policy. This deployment condition is reflected by AT:P in the CVSS 4.0 vector. Where no policy uses the SIP proxy, the vulnerable parsing path is not reached, which meaningfully limits exposure to appliances actually running SIP ALG inspection. Within PR:N/UI:N, no authentication or user interaction is needed once such a policy is present. The precise trigger (which SIP field or structure overflows the buffer) is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk inflation. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with the stack-based buffer overflow (CWE-120) yielding arbitrary code execution described by the vendor. The one tempering signal in the raw vector is AT:P (an attack requirement is present), which aligns with the description's condition that traffic must traverse a policy using the SIP proxy - exploitation is not against an arbitrary default surface but against a specific, in-use feature. The vuln.today decision label is act_now, and a vendor patch already exists, which together argue for prompt remediation. Signals that are MISSING: no EPSS exploitation-probability score was provided, so widespread-exploitation likelihood cannot be quantified; there is no CISA KEV listing in the input (status = not exploited per available data); and no SSVC automatable/technical-impact breakdown beyond the act_now label. No public exploit or PoC reference appears in the input. Net: treat as urgent on a network security appliance, with the caveat that active-exploitation and EPSS evidence are absent rather than confirming low risk.

A remote, unauthenticated attacker sends a specially crafted SIP request to a WatchGuard Firebox whose configuration includes a policy that uses the SIP proxy (ALG). The malformed request overflows a stack buffer in the SIP proxy's parsing path, allowing the attacker to execute arbitrary code on the firewall appliance. No public exploit code or PoC reference is identified in the available data.