SB2026022447 - Multiple DoS vulnerabilities in SonicOS

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-0399)

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a boundary error. A remote privileged user can send specially crafted data to the device, trigger a stack-based buffer overflow and perform a denial of service attack.

2) Format string error (CVE-ID: CVE-2026-0400)

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a format string error. A remote privileged user can supply a specially crafted input to the system and perform a denial of service attack

3) NULL pointer dereference (CVE-ID: CVE-2026-0401)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote privileged user cker can pass specially crafted data to the system and perform a denial of service (DoS) attack.

4) Out-of-bounds read (CVE-ID: CVE-2026-0402)

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a boundary condition. A remote privileged user can trigger an out-of-bounds read error and perform a denial of service attack. 

Remediation

Install update from vendor's website.

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0001