CVE Intelligence
Analysis AI-assisted

CVE-2026-32661: GUARDIANWALL MailSuite and Mail Security Cloud Stack-based Buffer Overflow

CVE-2026-32661 is a critical stack-based buffer overflow (CWE-121) in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version), reported through JPCERT/CC. The record describes possible arbitrary code execution after a remote, crafted request to the web service when pop3wallpasswd is configured to run with the grdnwww user privilege. No CISA KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-32661 is a stack-based buffer overflow (CWE-121) affecting the GUARDIANWALL MailSuite on-premises product and the GUARDIANWALL Mail Security Cloud SaaS offering from Canon Marketing Japan Inc. The record, which was reported through JPCERT/CC, states that a remote attacker can reach the flaw by sending a specially crafted request to the product's web service.

Impact

  • The record states that arbitrary code may be executed when the product is configured to run pop3wallpasswd with the grdnwww user privilege.
  • The CVSS 3.0 base score is 9.8 (critical), with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network attack, no privileges and no user interaction required, and high confidentiality, integrity and availability impact.
  • A CVSS 4.0 score of 9.3 is also listed.
  • SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • GUARDIANWALL Mail Security Cloud (SaaS version): the record lists versions before the maintenance on April 30 and version 2026.
  • GUARDIANWALL MailSuite (On-premises version): Ver 1.4.00 to Ver 2.4.26.

The version descriptions above are reproduced from the record and are informal, so exact affected builds should be confirmed with the vendor advisory.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is set to none, and the EPSS probability is 0.00731 (percentile 0.53071).

Remediation and mitigation

  • Review the vendor information published by Canon at Canon ITS security information and the JVN entry JVN35567473.
  • The record contains no fixed version. Ask the vendor which build or maintenance update addresses the issue for your deployment.
  • Until a fix is applied, limit exposure of the web service to trusted networks and review whether the pop3wallpasswd configuration is in use.
  • For SaaS customers, confirm with the vendor whether the maintenance referenced in the affected range has been applied to your tenant.

Detection guidance

  • Monitor web service logs for malformed or unusually large requests directed at the product interface.
  • Watch for unexpected child processes, service crashes or restarts associated with the grdnwww account.
  • Review inbound access to management and web interfaces and alert on access from unexpected sources.

Limitations of the available information

  • The record lists no fixed versions and no patch identifiers.
  • The affected version descriptions are informal and do not clearly enumerate every build.
  • The record does not include technical details of the triggering request, and this analysis does not provide them.
  • The record is in Deferred status at the time of collection, and the EPSS date in the record should be verified against the current feed.

Frequently asked questions

What kind of vulnerability is CVE-2026-32661?

It is a stack-based buffer overflow classified as CWE-121. The record says it may allow arbitrary code execution under a specific configuration.

Which products are affected?

The record lists GUARDIANWALL MailSuite on-premises from Ver 1.4.00 to Ver 2.4.26 and the GUARDIANWALL Mail Security Cloud SaaS version, with versions before the April 30 maintenance and version 2026.

Is this CVE known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. SSVC exploitation is recorded as none.

Is there a fixed version?

The record lists no fixed version. Check the Canon advisory and the JVN entry, and confirm the remediation path with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.