CVE-2026-85103

Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

En bref

Sévérité: CRITICAL 9.8
Exploitation: Exploitée selon l'ENISA depuis le 2026-09-25
EPSS: EPSS 4.29 % · centile 91 (2026-10-28)
État: PUBLISHED
Publiée: 2026-09-09
Mise à jour: 2026-09-10
Attribuée par: checkpoint
Statut NVD: Awaiting Analysis

Description

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	checkpoint
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · cve@checkpoint.com (Secondary)

Faiblesses (CWE)

CWE-122

Références européennes

ENISA EUVD · EUVD-2026-75010
GCVE · GCVE-0-2026-85103

Avis du CERT-FR

CERTFR-2026-AVI-1152 — Multiples vulnérabilités dans les produits Check Point · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
checkpoint · Quantum Security Gateway	affected R82.10 with Jumbo Hotfix Take 43 or below ; affected R82 with Jumbo Hotfix Take 125 or below ; affected R81.20 with Jumbo Hotfix Take 165 or below
checkpoint · Quantum Security Management	affected R82.10 with Jumbo Hotfix Take 43 or below ; affected R82 with Jumbo Hotfix Take 125 or below ; affected R81.20 with Jumbo Hotfix Take 165 or below

Références

https://support.checkpoint.com/results/sk/sk1000118

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD