CVE-2026-85103

Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

CVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-85103

Published

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85103

Published

Quantum Security Gateway

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Quantum Security Gateway",
                    "vendor": "checkpoint",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "R82.10 with Jumbo Hotfix Take 43 or below"
                        },
                        {
                            "status": "affected",
                            "version": "R82 with Jumbo Hotfix Take 125 or below"
                        },
                        {
                            "status": "affected",
                            "version": "R81.20 with Jumbo Hotfix Take 165 or below"
                        }
                    ]
                }

Quantum Security Management

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Quantum Security Management",
                    "vendor": "checkpoint",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "R82.10 with Jumbo Hotfix Take 43 or below"
                        },
                        {
                            "status": "affected",
                            "version": "R82 with Jumbo Hotfix Take 125 or below"
                        },
                        {
                            "status": "affected",
                            "version": "R81.20 with Jumbo Hotfix Take 165 or below"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON