Skip to main content

Check Point Quantum Security Gateway EUVDEUVD-2026-31819

| CVE-2026-48132 HIGH
Out-of-bounds Read (CWE-125)
2026-05-26 checkpoint GHSA-3h9p-9pvw-73vm
8.1
CVSS 3.1 · Vendor: checkpoint
Share

Severity by source

Vendor (checkpoint) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (checkpoint) · only source for this CVE.

CVSS VectorVendor: checkpoint

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 09:02 vuln.today
CVSS changed
May 26, 2026 - 15:22 NVD
7.4 (HIGH) 8.1 (HIGH)

DescriptionCVE.org

The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service (temporary interruption of VPN negotiations/traffic).

AnalysisAI

Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to crash the VPN processing service by sending specially crafted IKE packets over NAT-T (UDP/4500). Multiple supported releases (R81.10 and below, R81.20, R82, R82.10) are affected up to specific Jumbo Hotfix takes. No public exploit identified at time of analysis, and EPSS is low at 0.06% (17th percentile), suggesting limited near-term exploitation likelihood despite the 8.1 CVSS score.

Technical ContextAI

The flaw resides in the IKE (Internet Key Exchange) packet processing path of the Quantum Security Gateway's VPN service when NAT Traversal (NAT-T) is in use, which encapsulates IKE traffic in UDP/4500 to support clients behind NAT devices. The root cause is CWE-125 (Out-of-bounds Read): a length field within an IKE packet is not properly validated, causing the parser to read beyond the bounds of an allocated buffer when handling a malformed or attacker-crafted value. CPE data (cpe:2.3:a:checkpoint:quantum_security_gateway) confirms the vulnerability is in Check Point's enterprise VPN/firewall appliance software. While the tags include 'Information Disclosure' and 'Buffer Overflow,' the description and CWE-125 indicate the observed effect is service termination rather than memory exfiltration or code execution.

RemediationAI

Patch available per vendor advisory - install the next Jumbo Hotfix Accumulator for your branch as published in Check Point sk184982 (https://support.checkpoint.com/results/sk/sk184982), specifically a take higher than R81.20 Take 127, R82 Take 91, or R82.10 Take 19, and upgrade R81.10 (and earlier) to a supported, patched branch since all R81.10 releases are listed as affected. If patching cannot be performed immediately, compensating controls include restricting UDP/4500 (NAT-T) ingress on the gateway to known VPN peer IP addresses via an upstream firewall ACL - note that this breaks roaming/mobile VPN clients whose source IPs are unpredictable - or temporarily disabling NAT-T where peer topology permits, which will break IKE for any client behind NAT and is generally not viable for remote-access VPN deployments. Monitor the VPN daemon for unexpected restarts as a detection signal until the patch is applied.

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu

CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V

CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

Share

EUVD-2026-31819 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy