Executive brief
A vulnerability in Check Point Security Gateways can cause the VPN service to crash and restart unexpectedly. This affects the gateway's ability to handle secure remote connections, potentially leading to a temporary loss of VPN connectivity for users and site-to-site tunnels. The issue is triggered when the device processes specifically malformed network traffic related to VPN negotiations.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the VPN processing service of Check Point Security Gateways. The flaw is rooted in the improper validation of length fields within Internet Key Exchange (IKE) packets when encapsulated for NAT Traversal (NAT-T) on UDP port 4500. A remote, unauthenticated attacker can exploit this by sending specially crafted or malformed IKE packets. Successful exploitation causes the VPN service to terminate unexpectedly, resulting in a denial of service (DoS) for VPN negotiations and existing traffic until the service restarts.
Affected products
- Check Point Security Gateway
Timeline
- 2026-05-26: advisory: Initial advisory published by Check Point and NVD record created.