Executive brief
A vulnerability in Check Point VPN services could allow an attacker to crash the VPN gateway, preventing employees from securely accessing the corporate network. The issue occurs when the system incorrectly processes a specific type of malformed connection request. This results in a service outage that disrupts remote work and secure site-to-site communications until the service is restored.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Check Point VPN daemon (VPND) during the reassembly of IKE fragments. The vulnerability is triggered when the service receives an unexpected IKE fragment value, specifically a sequence number of zero, on UDP port 500 during the early stages of a connection attempt. An unauthenticated remote attacker can exploit this by sending a specially crafted IKE packet, leading to an out-of-bounds write. While the primary reported impact is a service crash (Denial of Service), the underlying heap overflow could theoretically allow for broader memory corruption. The attack requires no user interaction but is categorized with high complexity, likely due to the specific timing or state requirements of the IKE negotiation phase.
Affected products
- Check Point VPN Service (VPND)
Timeline
- 2026-05-26: advisory: Initial advisory published by Check Point and NVD