CVE-2025-46373

HIGH7.8

A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7

Published Nov 18, 2025

Modified 2 months ago

Details

A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.8 may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys". The attacker would need to bypass the Windows heap integrity protections

Affected Packages

FortiClient

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

References

ADVISORY

https://fortiguard.fortinet.com/psirt/FG-IR-25-125

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-46373

Aliases

FG-IR-25-125

CVSS Analysis

CVSS v3.1