ZDI 2026-09-30

ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2026-18145

Machine-generated analysis · WAYSCloud LLM

Remote code execution is possible via a stack-based buffer overflow in WatchGuard FireWare OS's spamd statushdlr, but authentication is required.

Context

The advisory concerns WatchGuard FireWare OS, specifically the spamd statushdlr component. It describes a stack-based buffer overflow that can be remotely exploited to execute arbitrary code, requiring authentication. The ZDI assigned a CVSS base score of 7.2.

Operator considerations

Check inventory for WatchGuard FireWare OS installations and verify versions.
Log any attempts to access the spamd statushdlr component.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-18145.

Read the full advisory on ZDI →