{"id":"CVE-2026-85103","aliases":["EUVD-2026-75010","GHSA-g4cm-76f6-qvmc"],"status":"published","title":"Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding","description":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04287,"percentile":0.91184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-122"],"published":"2026-09-09T13:00:42Z","modified":"2026-09-10T04:18:18Z","exploitation":[{"source":"euvd","since":"2026-09-25"}],"products":[{"vendor":"checkpoint","product":"quantum security gateway"},{"vendor":"checkpoint","product":"quantum security management"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk1000118"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85103"},{"url":"https://github.com/advisories/GHSA-g4cm-76f6-qvmc"}],"sources":{"cve":[{"id":"CVE-2026-85103","title":"Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding","description":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","status":"published","published":"2026-09-09T13:00:42.088Z","modified":"2026-09-10T03:56:41.934Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-75010","description":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","status":"published","published":"2026-09-09T13:00:42Z","modified":"2026-09-10T03:56:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-09-25","updated_at":"2026-11-02T17:28:25.63332Z"}],"ghsa":[{"id":"GHSA-g4cm-76f6-qvmc","title":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated...","description":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","status":"published","published":"2026-09-09T15:35:09Z","modified":"2026-09-09T15:35:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:11:38.712835Z"}],"nvd":[{"id":"CVE-2026-85103","description":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","status":"published","published":"2026-09-09T13:20:43.997Z","modified":"2026-09-10T04:18:18.39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:45.93749Z"}]}}