EN PT-BR
← Voltar ao feed
medium

CVE-2026-0250: MitM-triggered buffer overflow in Palo Alto GlobalProtect App clients (Windows, macOS, Linux, Android, ChromeOS)

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 04:15 · coletado há 1 hora

Palo Alto Networks published the advisory for CVE-2026-0250, a buffer overflow in its GlobalProtect App client that a man-in-the-middle attacker can trigger while requests and responses are exchanged between the client and a GlobalProtect Portal or Gateway. The vendor warns that this can disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. It rates the flaw MEDIUM with a CVSS 4.0 base score of 5.2 (security.paloaltonetworks.com), and it states that no special configuration is needed to be affected. Palo Alto Networks is not aware of any malicious exploitation and lists no known workarounds, so upgrading the client is the only available fix (security.paloaltonetworks.com). The iOS app is not affected (security.paloaltonetworks.com), and the advisory was first published on 2026-05-13 and last updated on 2026-11-10 (security.paloaltonetworks.com).

Entenda a falha

A vulnerabilidade

CVE-2026-0250 is a buffer overflow (CWE-787, out-of-bounds write) in the Palo Alto Networks GlobalProtect App client. It is triggered while the client exchanges requests and responses with a GlobalProtect Portal or Gateway. The attacker must be a man in the middle on an adjacent network, needs no privileges or user interaction, and no special configuration is required. Impact is disruption of system processes and potentially arbitrary code execution with SYSTEM privileges. The vendor rates it MEDIUM (CVSS 4.0 score 5.2; the story also cites a CVSS-B base of 7.7). It affects the 6.0, 6.1, 6.2 and 6.3 branches on Windows, macOS, Linux, Android and ChromeOS, plus UWP App 6.3 on Windows. Fixes include 6.3.3-h9 and 6.2.8-h10 (Windows/macOS), 6.0.13 (Windows/macOS), 6.0.15 (Linux), 6.3.3-h15 (Linux), 6.3.5 (Android/ChromeOS) and UWP 6.3.3-h10. iOS is not affected.

Como funciona

The GlobalProtect App client connects to a Portal or Gateway and exchanges requests and responses with it. A man in the middle on the network path can influence the data the client receives during this exchange. The client processes that data and writes it into a memory buffer. At that step the write can go beyond the buffer's bounds, corrupting memory. That can crash system processes or, potentially, let code run with SYSTEM privileges. The articles do not detail which specific message or field is involved.

Por que é vulnerável

The vendor classifies the root cause as CWE-787, an out-of-bounds write: the client writes data past the end of a buffer while handling the connection exchange with the Portal or Gateway. The advisory gives no further detail on why it went unnoticed or what exactly the fix changes in the code; the remedy is upgrading to the fixed client builds.

Como foi descoberta

Palo Alto Networks says its internal security research teams found the issue. The advisory was first published on 2026-05-13 and last updated on 2026-11-10. The vendor is not aware of any malicious exploitation and lists no workarounds.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 04:28.

Detalhes técnicos

  • Weakness: the vendor classifies the bug as CWE-787 out-of-bounds write and lists CAPEC-540 (security.paloaltonetworks.com).
  • Scoring: the CVSS 4.0 vector marks the product's confidentiality, integrity and availability impact as high, while the CVSS-B base score is 7.7 and the vendor marks the flaw as not automatable (security.paloaltonetworks.com).
  • Prerequisites: the attacker must sit on an adjacent network as a man in the middle, attack requirements are present, and no privileges or user interaction are needed (security.paloaltonetworks.com).
  • Discovery: Palo Alto Networks found the issue through its internal security research teams (security.paloaltonetworks.com).

Remediação

  • 6.3 on Windows and macOS (6.3.0 through 6.3.3-h8): upgrade to 6.3.3-h9 (6.3.3-999) or later (security.paloaltonetworks.com).
  • 6.2 on Windows and macOS (6.2.0 through 6.2.8-h9): upgrade to 6.2.8-h10 (6.2.8-948) or later (security.paloaltonetworks.com).
  • 6.0 on Windows and macOS (6.0.0 through 6.0.12): upgrade to 6.0.13 or later (security.paloaltonetworks.com).
  • 6.0 on Linux (6.0.0 through 6.0.14): upgrade to 6.0.15 or later (security.paloaltonetworks.com).
  • 6.2 and 6.3 on Linux (6.2.0 through 6.3.3-h14): upgrade to 6.3.3-h15 or later (security.paloaltonetworks.com).
  • 6.3 on Android and ChromeOS (6.3.0 through 6.3.4): upgrade to 6.3.5 or later (security.paloaltonetworks.com).
  • 6.1 and 6.0 on Android and ChromeOS: the solution table offers 6.1.14 or 6.3.4 as fixes, but its own product status lists 6.3.4 as affected, so 6.3.5 is the safer target (security.paloaltonetworks.com).
  • GlobalProtect UWP App 6.3 on Windows (before 6.3.3-h10): upgrade to 6.3.3-h10 or later (security.paloaltonetworks.com).
  • iOS: no action needed (security.paloaltonetworks.com).
  • The advisory still marks some fixes with pending ETAs, including 6.0.15 for Linux, Android and ChromeOS and 6.3.3-h15 for Linux, so the release must be confirmed before deployment (security.paloaltonetworks.com).

Linha do tempo

  1. security.paloaltonetworks.com ↗ · pub. 10/11/2026 04:15 · coletado 10/11 04:00 primeiro registro

    CVE-2026-0250: MitM-triggered buffer overflow in Palo Alto GlobalProtect App clients (Windows, macOS, Linux, Android, ChromeOS)

    ler a análise desta fonte

    Palo Alto Networks published the advisory for CVE-2026-0250, a buffer overflow in its GlobalProtect App client that a man-in-the-middle attacker can trigger while requests and responses are exchanged between the client and a GlobalProtect Portal or Gateway. The vendor warns that this can disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. It rates the flaw MEDIUM with a CVSS 4.0 base score of 5.2 (security.paloaltonetworks.com), and it states that no special configuration is needed to be affected. Palo Alto Networks is not aware of any malicious exploitation and lists no known workarounds, so upgrading the client is the only available fix (security.paloaltonetworks.com). The iOS app is not affected (security.paloaltonetworks.com), and the advisory was first published on 2026-05-13 and last updated on 2026-11-10 (security.paloaltonetworks.com).

    Technical Details

    • Weakness: the vendor classifies the bug as CWE-787 out-of-bounds write and lists CAPEC-540 (security.paloaltonetworks.com).
    • Scoring: the CVSS 4.0 vector marks the product's confidentiality, integrity and availability impact as high, while the CVSS-B base score is 7.7 and the vendor marks the flaw as not automatable (security.paloaltonetworks.com).
    • Prerequisites: the attacker must sit on an adjacent network as a man in the middle, attack requirements are present, and no privileges or user interaction are needed (security.paloaltonetworks.com).
    • Discovery: Palo Alto Networks found the issue through its internal security research teams (security.paloaltonetworks.com).

    Remediation

    • 6.3 on Windows and macOS (6.3.0 through 6.3.3-h8): upgrade to 6.3.3-h9 (6.3.3-999) or later (security.paloaltonetworks.com).
    • 6.2 on Windows and macOS (6.2.0 through 6.2.8-h9): upgrade to 6.2.8-h10 (6.2.8-948) or later (security.paloaltonetworks.com).
    • 6.0 on Windows and macOS (6.0.0 through 6.0.12): upgrade to 6.0.13 or later (security.paloaltonetworks.com).
    • 6.0 on Linux (6.0.0 through 6.0.14): upgrade to 6.0.15 or later (security.paloaltonetworks.com).
    • 6.2 and 6.3 on Linux (6.2.0 through 6.3.3-h14): upgrade to 6.3.3-h15 or later (security.paloaltonetworks.com).
    • 6.3 on Android and ChromeOS (6.3.0 through 6.3.4): upgrade to 6.3.5 or later (security.paloaltonetworks.com).
    • 6.1 and 6.0 on Android and ChromeOS: the solution table offers 6.1.14 or 6.3.4 as fixes, but its own product status lists 6.3.4 as affected, so 6.3.5 is the safer target (security.paloaltonetworks.com).
    • GlobalProtect UWP App 6.3 on Windows (before 6.3.3-h10): upgrade to 6.3.3-h10 or later (security.paloaltonetworks.com).
    • iOS: no action needed (security.paloaltonetworks.com).
    • The advisory still marks some fixes with pending ETAs, including 6.0.15 for Linux, Android and ChromeOS and 6.3.3-h15 for Linux, so the release must be confirmed before deployment (security.paloaltonetworks.com).