Palo Alto Networks PAN-OS: Buffer Overflow Vulnerability (CVE-2026-0326)

A buffer overflow vulnerability (CWE-787) in Palo Alto Networks PAN-OS software allows an unauthenticated, remote attacker to cause a service process crash or potential memory corruption. The vulnerability is triggered under specific conditions: when SCTP is enabled, when a DNS proxy object is configured and enabled on the firewall, or when OSPFv3 routing is enabled on an IPv6 interface using weak authentication (ESP-NULL). Palo Alto Networks confirmed this was discovered internally and there is no evidence of active exploitation.

Impact

Successful exploitation results in a service process crash or potential memory corruption on the affected firewall. This primarily impacts service availability. Panorama and Prisma Access are not affected.

Recommendation

• Upgrade PAN-OS to the specified fixed versions immediately: 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, or 11.1.16-h5.
• For Cloud NGFW, coordinate with support for an on-demand upgrade.
• If patching is not immediately feasible, mitigate the risk by detaching SCTP protection profiles, disabling unused DNS proxy objects, and reconfiguring OSPFv3 authentication profiles to avoid ESP-NULL settings.