Out-of-bounds write in Palo Alto Networks, Inc. products - CVE-2026-0297

Vulnerability identifier: #VU143208

CSH Severity: High

CVSS v4: 9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2026-0297

CWE-ID: CWE-787

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the UDP tunnel handshake processing in the GlobalProtect App when handling a UDP tunnel handshake. A remote attacker on the local network can act as a man-in-the-middle or a rogue gateway to execute arbitrary code with highest privileges on the system (e.g. under SYSTEM or root).

No special configuration is required to be affected by this issue.

GlobalProtect app for Windows
GlobalProtect App for Linux
GlobalProtect App for macOS
GlobalProtect App for iOS
GlobalProtect App for Android
GlobalProtect App for Chrome OS

Install security update from vendor's website.

GlobalProtect app for Windows - addressed in versions 6.0.15, 6.2.8-h13, 6.3.3-h14
GlobalProtect App for Linux - addressed in versions 6.0.15, 6.3.3-h15
GlobalProtect App for macOS - addressed in versions 6.0.15, 6.2.8-h13, 6.3.3-h14
GlobalProtect App for iOS - addressed in versions 6.0.15, 6.3.5
GlobalProtect App for Android - addressed in versions 6.0.15, 6.3.5
GlobalProtect App for Chrome OS - addressed in versions 6.0.15, 6.3.5

• https://security.paloaltonetworks.com/CVE-2026-0297

• Buffer overflow in GlobalProtect app