EUVD-2026-57188
GHSA-95wv-6wmf-f8vm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N and AC:H because exploitation requires network DNS interception positioning but no credentials or interaction; full C/I/A reflects arbitrary code execution potential.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.
Articles & Coverage 1
AnalysisAI
Remote code execution in Fortinet FortiClientWindows affects versions 7.2.0-7.2.11 and 7.4.0-7.4.3, exploitable by any attacker capable of intercepting or forging DNS responses destined for the target host. Maliciously crafted DNS response packets trigger a classic buffer overflow (CWE-120) in the client's DNS parsing logic, allowing arbitrary code execution without requiring any credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be in a position to alter or craft DNS responses delivered to the target host - this is the primary limiting condition reflected in AC:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the technical impact - full confidentiality, integrity, and availability compromise - while the High complexity rating (AC:H) reflects the non-trivial prerequisite of controlling or intercepting DNS traffic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade FortiClientWindows to a version outside the affected ranges. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an immediate inventory of all FortiClient Windows installations to identify systems running versions 7.2.0-7.2.11 or 7.4.0-7.4.3, then implement mandatory DNS traffic redirection to validated internal resolvers and enable DNS query monitoring on network perimeter devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today