{"id":"CVE-2026-85103","published":"2026-09-09T13:00:42Z","modified":"2026-09-10T03:56:41Z","title":"Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding","vendor":"checkpoint","product":"Quantum Security Gateway","tier":"core","eol":null,"affectedVersions":[{"vendor":"checkpoint","product":"Quantum Security Gateway","versions":["R82.10 with Jumbo Hotfix Take 43 or below","R82 with Jumbo Hotfix Take 125 or below","R81.20 with Jumbo Hotfix Take 165 or below"]},{"vendor":"checkpoint","product":"Quantum Security Management","versions":["R82.10 with Jumbo Hotfix Take 43 or below","R82 with Jumbo Hotfix Take 125 or below","R81.20 with Jumbo Hotfix Take 165 or below"]}],"description":{"text":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","provenance":"source","from":"CVE.org"},"summary":{"text":"A heap-based buffer overflow in the VPN certificate ASN.1 decoding component of Check Point Quantum Security Gateway (and Quantum Security Management) can be triggered when the software parses certificates. An unauthenticated remote attacker with network access can exploit it without user interaction or a specific configuration to execute arbitrary code on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:53Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04287,"percentile":0.91106,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":18,"pulses":[{"name":"Teams vishing: fake “IT” tenant","url":"https://otx.alienvault.com/pulse/6ae4ea1b385df05188293ea5","created":"2026-10-30"},{"name":"EbeeOct2026 Pt6","url":"https://otx.alienvault.com/pulse/6ae18a35499a00890a824f6c","created":"2026-10-28"},{"name":"Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access","url":"https://otx.alienvault.com/pulse/6ae03ee6ee2d553bce6c449b","created":"2026-10-27"},{"name":"Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access","url":"https://otx.alienvault.com/pulse/6adf5e6a54877322e0ed8a09","created":"2026-10-26"},{"name":"Graphalgo DPRK: Malicious Terraform Providers & Go Modules on HashiCorp Registry","url":"https://otx.alienvault.com/pulse/6ac9d59d0c71c16da4514846","created":"2026-10-10"},{"name":"Dell CSM <1.17.0 Critical Unauth Admin & K8s Node Root (CVE-2026-63688 et al.)","url":"https://otx.alienvault.com/pulse/6ac09adb9967cdb87ad079f8","created":"2026-10-03"},{"name":"FortiMail CVE-2026-104286 Zero-Day Path Traversal Exploitation","url":"https://otx.alienvault.com/pulse/6abf4984c1ea44f99b83f00b","created":"2026-10-02"},{"name":"MikroTrick: MikroTik RouterOS Unauth SSH Admin Takeover (CVE-2026-67279 + CVE-2026-86060)","url":"https://otx.alienvault.com/pulse/6abca685e7197569eb428d61","created":"2026-09-30"},{"name":"The Psychedelic Stealer: When a CAPTCHA Becomes an Installer","url":"https://otx.alienvault.com/pulse/6aba01ca7e58f395888857cf","created":"2026-09-28"},{"name":"MemTensor npm/PyPI Compromise Delivers sckit Stealer (skyleen.fr)","url":"https://otx.alienvault.com/pulse/6ab8b1e2113aa027e82a2a68","created":"2026-09-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk1000118","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-75010","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010","exploited":true,"exploitedSince":"2026-09-25","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-09-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-85103","provenance":"source"},{"date":"2026-09-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":28.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.22,"detail":"percentile 0.9111"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.9,"detail":"18 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}