EUVD-2026-57188
GHSA-95wv-6wmf-f8vm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N and AC:H because exploitation requires network DNS interception positioning but no credentials or interaction; full C/I/A reflects arbitrary code execution potential.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.
Articles & Coverage 1
AnalysisAI
Remote code execution in Fortinet FortiClientWindows affects versions 7.2.0-7.2.11 and 7.4.0-7.4.3, exploitable by any attacker capable of intercepting or forging DNS responses destined for the target host. Maliciously crafted DNS response packets trigger a classic buffer overflow (CWE-120) in the client's DNS parsing logic, allowing arbitrary code execution without requiring any credentials or user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity requirement (DNS MITM/poisoning position) meaningfully limits opportunistic exploitation.
Technical ContextAI
FortiClientWindows is Fortinet's enterprise endpoint security and VPN client for Windows systems. The vulnerability resides in the client's DNS response processing code, which copies input data into a fixed-size buffer without validating the length of attacker-controlled content (CWE-120: Buffer Copy Without Checking Size of Input). This classic stack or heap buffer overflow class can overwrite adjacent memory regions, enabling control-flow hijacking and arbitrary code execution in the context of the FortiClient process. The attack vector requires the adversary to be in a position to deliver crafted DNS responses to the victim host - achievable via DNS cache poisoning, rogue DNS server on a shared network, ARP spoofing/MITM on local segments, or compromised upstream DNS infrastructure. Affected CPE covers FortiClientWindows in the 7.2 and 7.4 release trains as reported by Fortinet PSIRT (FG-IR-26-156).
RemediationAI
Upgrade FortiClientWindows to a version outside the affected ranges. Per Fortinet's advisory FG-IR-26-156 (https://fortiguard.fortinet.com/psirt/FG-IR-26-156), users should consult the Fortiguard portal for the specific recommended fixed version, as the input data does not enumerate an exact patched release number - patch status is confirmed as available per vendor advisory. Until patching is complete, compensating controls include enforcing use of encrypted, authenticated DNS (DNS-over-HTTPS or DNS-over-TLS with certificate pinning) to prevent response forgery, restricting FortiClient endpoints to operate only on trusted networks or through established VPN tunnels before DNS resolution occurs, and deploying DNSSEC validation to detect tampered DNS responses. Note that network-level DNS controls reduce but do not eliminate risk if the upstream resolver or local network segment is already compromised. EMS (FortiClient Enterprise Management Server) administrators should prioritize pushing updates to remote and mobile workers who frequently connect from untrusted networks, as these represent the highest-risk deployment scenarios.
More in Forticlient
View allA privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privil
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel
DHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7
An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Ma
The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which ma
In FortiClientWindows 5.4.1 and 5.4.2, an attacker may escalate privilege via a FortiClientNamedPipe vulnerability. Rate
A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.
The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not
Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attacke
An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.1
AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0
Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today