CVE-2026-32661

CriticalCVSS 9.3/10Last modified Oct 26, 2026

Description

Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd with grdnwww user privilege.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-121

Affected software

VendorProductVersions
Canon Marketing Japan Inc.GUARDIANWALL MailSuite (On-premises version)Ver 1.4.00 to Ver 2.4.26
Canon Marketing Japan Inc.GUARDIANWALL Mail Security Cloud (SaaS version)versions before the maintenance on April 30; 2026

References

Timeline

Published
May 13, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-326625.3Development and test API endpoints are present that mirror production functionality.CVE-2026-326636.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the saCVE-2026-326657.5In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streamsCVE-2026-326667.5WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additiCVE-2026-326678.5Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. UnpriviCVE-2026-326699.8Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed CVE-2026-326708.5Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation CVE-2026-326726.8Null pointer dereference for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of serviCVE-2026-326738.7A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or AdministratorCVE-2026-326777.3Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege.CVE-2026-326788.7Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings wiCVE-2026-326798.4The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon