CVE-2026-85103: Check Point Quantum Gateway & Management Server VPN ASN.1 Heap Buffer Overflow RCE

HERMES

HERMES THREAT SCORE & ENTERPRISE MANAGEMENT PLANE SURFACE

Target: Check Point Security Gateway & Management Server (vpnd / cpm / fwm)

Confidence: 99%

96 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 19 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-85103 at 9.8 (CRITICAL, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns 96 (CRITICAL) reflecting the catastrophic risk of Security Management Server (SMS) compromise and global fleet manipulation.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-85103: Check Point VPN Certificate ASN.1 Decoding Heap Buffer Overflow RCEVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTCheck Point Quantum Security Gateway (Gaia OS)

99% VERY_HIGH

Unified security operating system powering Check Point Quantum Security Gateways, Spark appliances, and cloud firewalls.

🔍 Why is this related? (Evidence & Provenance)

“Directly disclosed in Check Point advisory sk1000118 affecting Gateways and Security Management Servers.”

Supporting Verified Evidence:

• [government_confirmation]Dutch NCSC and European cybersecurity authorities issued critical alert confirming imminent exploitation of Check Point VPN certificate trust validation and ASN.1 decoding buffer overflow. — Source: Dutch NCSC / Check Point / CERT-FR: Dutch NCSC & Check Point Security Advisory: Imminent Exploitation of Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) (Reliability: VERY_HIGH)

→ affectsPRODUCTCheck Point Security Management

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Check Point Security Management documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Security Advisory: CWE-122 Heap-based Buffer Overflow

CVSS v3.1: 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-122: Heap-based Buffer Overflow. Disclosed in Check Point Security Advisory sk1000118. Remediated via LivePatch Take 24 and Jumbo Hotfix Accumulators.

Threat Intelligence Alert: Dual Gateway and Management Plane Risk

Unlike perimeter-only flaws, CVE-2026-85103 compromises both Quantum Security Gateways and Security Management Servers (SMS). A remote attacker achieving RCE on a management server can extract Secure Internal Communication (SIC) certificates and push arbitrary policies and backdoors across every managed gateway in the worldwide enterprise estate.

Executive Summary

CVE-2026-85103 is a critical heap-based buffer overflow occurring during the decoding of ASN.1 BER/DER structures within X.509 VPN certificates on Check Point Gaia OS. When parsing malformed nested length headers in certificate payloads, the decoding engine allocates an insufficient heap buffer and performs an unbounded memory copy. This enables an unauthenticated remote attacker to achieve reliable arbitrary code execution with administrative privileges on both perimeter gateways and central security management servers.

---

1. Technical Context & Affected Software Matrix

The vulnerability resides within the shared ASN.1 certificate deserialization library utilized by the VPN service (vpnd) on Security Gateways and the central policy/certificate management processes (cpm, fwm) on Security Management Servers.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-85103	Check Point Security Advisory sk1000118
Affected Product	checkpoint:gaia	Quantum Security Gateway & Security Management Server
Vulnerable Component	ASN.1 Certificate Parser (vpnd / cpm / fwm)	X.509 BER / DER Length Calculation Routine
Weakness Class	CWE-122: Heap-based Buffer Overflow	Memory Safety / Integer Signedness Mismatch
CVSS v3.1 Score	9.8 (CRITICAL / Hermes Score 96)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed Versions	R82.20, R82.10 Take 44, R82 Take 126, R81.20 Take 166, LivePatch Take 24	Emergency security release & dynamic hotfix
MITRE ATT&CK	T1190 - Exploit Public-Facing Application, T1210 - Exploitation of Remote Services	Initial Access / Lateral Movement / Impact
Forensic Cross-Reference	Linux Process Memory and Heap Corruption Forensics	Heap chunk metadata analysis, ptmalloc forensics

Affected Release Branches

• Check Point Gaia R82.10: Vulnerable (Fixed in Jumbo Hotfix Take 44 or LivePatch Take 24)
• Check Point Gaia R82: Vulnerable (Fixed in Jumbo Hotfix Take 126 or LivePatch Take 24)
• Check Point Gaia R81.20: Vulnerable (Fixed in Jumbo Hotfix Take 166 or LivePatch Take 24)
• Check Point Gaia R81.10, R81, R80.40 (End of Support): Vulnerable (No official patches; upgrade mandatory)
• Security Management Servers & Multi-Domain (MDS): Vulnerable across all active management branches
• Check Point Gaia R82.20: Not affected by design.

---

2. In-Depth Technical Decomposition & Root Cause

X.509 certificates rely on Abstract Syntax Notation One (ASN.1) encoded with Distinguished Encoding Rules (DER). ASN.1 objects are serialized as Tag-Length-Value (TLV) triplets. In DER encoding, the length field specifies the exact byte size of the value payload.

In Check Point’s ASN.1 parser implementation, decoding nested constructed octet strings and certificate extensions involves dynamic memory allocation on the ptmalloc heap:

// Decompiled representation of ASN.1 length calculation flaw in Check Point libcpasn1
int asn1_decode_octet_string(asn1_stream_t *stream, unsigned char **out_buf, size_t *out_len) {
    unsigned char tag = stream_read_byte(stream);
    uint32_t declared_len = 0;

    if (stream_read_length(stream, &declared_len) != 0) {
        return ASN1_ERR_DECODE;
    }

    /* VULNERABILITY (sk1000118 / CWE-122):
     * declared_len is stored as a 32-bit unsigned integer, but the internal chunk
     * allocation arithmetic performs a signed 16-bit truncation during nested structure
     * reassembly: (int16_t)declared_len + sizeof(asn1_hdr_t).
     * If declared_len is crafted (e.g. 0x00010040), the allocated chunk is only 0x48 bytes.
     * The subsequent stream_read_bytes() copies the full declared_len (65600 bytes),
     * completely overrunning the allocated heap chunk! */
    int16_t alloc_size = (int16_t)declared_len + sizeof(asn1_hdr_t);
    unsigned char *chunk = (unsigned char *)malloc(alloc_size);
    if (!chunk) {
        return ASN1_ERR_NO_MEM;
    }

    // Out-of-bounds heap write over adjacent ptmalloc chunk headers and function pointers
    memcpy(chunk + sizeof(asn1_hdr_t), stream->cursor, declared_len);
    *out_buf = chunk;
    *out_len = declared_len;
    return ASN1_SUCCESS;
}

Because heap chunk headers in ptmalloc (chunksize, prev_size, flags) and adjacent object pointers are overwritten, an attacker who primes the heap with predictable chunk allocations (heap grooming) can achieve arbitrary memory write primitives, hijack vtable pointers, and execute native code with full root/admin privileges.

---

3. Attack Scenarios & Threat Modeling

1. Target Selection: Attacker identifies exposed IKE ports (UDP 500/4500) on an edge gateway or exposed Check Point SmartConsole management ports (TCP 18190, 19009, 443).
2. Heap Preparation (Grooming): Attacker sends a burst of fragmented IKE proposals or TLS client hellos to arrange predictable chunk layouts in the daemon’s heap.
3. Payload Ingestion: Attacker delivers an X.509 certificate payload containing an ASN.1 extension with an integer-truncated length field and embedded shellcode.
4. Heap Overflow Trigger: The parser computes an undersized buffer allocation and copies oversized certificate data, corrupting neighboring chunks.
5. Arbitrary Code Execution: The corrupted function pointer is invoked upon parsing completion, executing shellcode in the context of vpnd (gateway) or cpm (management server).
6. Fleet Manipulation: When executed against the Security Management Server, the attacker steals SIC keys and distributes compromised security policies to all connected firewalls globally.

---

4. Forensic Detection, Artifacts & System Logs

Heap Corruption Log Signatures

Inspect /var/log/messages and kernel ring buffer (dmesg) for heap failure markers: malloc(): memory corruption, corrupted double-linked list, or general protection fault in cpm / vpnd.

User-Mode Crash Dumps

Check /var/log/dump/usermode/ for generated core files: core.vpnd.* or core.cpm.*. Extract backtraces using gdb to inspect registers at crash time.

Threat Hunting Signatures

Suricata ASN.1 Anomaly Rule

emerging_checkpoint_cve_2026_85103.rules

alert udp any any -> $EXTERNAL_NET [500,4500] (
    msg:"HERMES INTEL - Check Point VPN Certificate ASN.1 Oversized Length Field (CVE-2026-85103)";
    flow:to_server;
    content:"|06|"; distance:16; within:1; # Certificate Payload
    content:"|30 84 00 01|"; distance:0; within:10; # 4-byte definite ASN.1 length > 65535
    threshold:type limit, track by_src, count 1, seconds 300;
    classtype:attempted-admin;
    sid:202685103; rev:1;
)

Sigma Rule

sigma_checkpoint_cpm_anomaly.yaml

title: Check Point Management Daemon cpm Heap Anomaly
id: cve-2026-85103-cpm-crash
status: critical
description: Detects abnormal termination or child process execution originating from Check Point Management Server cpm daemon.
logsource:
    category: application
    product: checkpoint
detection:
    selection:
        EventMessage|contains:
            - 'corrupted double-linked list'
            - 'cpm: malloc'
            - 'fwm: segfault'
    condition: selection
level: critical

---

5. Remediation & Hardening Guidelines

To fully mitigate CVE-2026-85103, security administrators must apply emergency hotfixes across both gateways and management servers:

1. Deploy LivePatch Take 24 Immediately: Run cplp apply or utilize SmartConsole CPUSE to distribute LivePatch Take 24 across all gateways and management appliances without service disruption.
2. Upgrade Jumbo Hotfix Accumulator:
   • R82.10: Take 44 or higher.
   • R82: Take 126 or higher.
   • R81.20: Take 166 or higher.
3. Isolate Management Interfaces: Ensure Check Point Security Management Servers (SMS) and SmartConsole ports (TCP 18190, TCP 19009, TCP 443) are strictly restricted to dedicated, air-gapped Out-of-Band (OOB) management networks. Never expose management interfaces directly to the Internet.
4. Forensic Reference: For comprehensive memory dumping and heap analysis procedures on Linux/Gaia OS, consult our guide on Linux Process Memory and Heap Corruption Forensics.