CVE-2026-18145: Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution
Published Sep 29, 2026
·Updated
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.
Affected Software
1 affected component
WatchGuard Fireware OS
Event History
Sep 29, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
RemedyDescriptionWeakness
Sep 30, 2026
Data Sourced
via NVD·12:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated and have administrator privileges, and must be able to send a specially crafted management request to the spamBlocker (spamd) service.
2
What could exploitation allow an attacker to do?
Successful exploitation can crash the spamd service and may allow arbitrary code execution on the affected WatchGuard Fireware OS device.