# CVE-2026-48131: Check Point VPN heap overflow in VPND IKE fragment reassembly

Source: https://junglewise.ai/threats/cve-2026-48131-check-point-vpn-heap-overflow-in-vpnd-ike-fragment-reassembly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-48131 · Severity: high · CVSS 8.1 · Published 2026-05-26

A vulnerability in Check Point VPN services could allow an attacker to crash the VPN gateway, preventing employees from securely accessing the corporate network. The issue occurs when the system incorrectly processes a specific type of malformed connection request. This results in a service outage that disrupts remote work and secure site-to-site communications until the service is restored.

Vendors: [Check Point](https://junglewise.ai/threats/vendors/check-point).

## Quick answers

**Is CVE-2026-48131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48131 being exploited in the wild.

**How severe is CVE-2026-48131?** High severity, with a CVSS score of 8.1, published 26 May 2026.

**Which products and versions are affected?** Check Point VPN Service (VPND).

**Is there a fix for CVE-2026-48131?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48131 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48131?** Check whether you run Check Point VPN Service. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the Check Point VPN daemon (VPND) during the reassembly of IKE fragments. The vulnerability is triggered when the service receives an unexpected IKE fragment value, specifically a sequence number of zero, on UDP port 500 during the early stages of a connection attempt. An unauthenticated remote attacker can exploit this by sending a specially crafted IKE packet, leading to an out-of-bounds write. While the primary reported impact is a service crash (Denial of Service), the underlying heap overflow could theoretically allow for broader memory corruption. The attack requires no user interaction but is categorized with high complexity, likely due to the specific timing or state requirements of the IKE negotiation phase.

## Affected products

- Check Point VPN Service (VPND)

## Timeline

- 2026-05-26: advisory: Initial advisory published by Check Point and NVD

## References

- [https://support.checkpoint.com/results/sk/sk184981](https://support.checkpoint.com/results/sk/sk184981)