Description

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T12:19:47.017Z",
  "pubdate": "2026-08-12T12:19:47.017Z",
  "executiveSummary": "A buffer copy without checking the size of input, commonly known as a classic buffer overflow vulnerability, has been identified in Fortinet FortiClientWindows. The flaw exists in the handling of DNS responses processed by the targeted host. Successful exploitation of this vulnerability allows an unauthenticated remote attacker capable of tampering with or crafting malicious DNS responses to execute arbitrary code on the victim system. The affected products include FortiClientWindows versions 7.4.0 through 7.4.3 and versions 7.2.0 through 7.2.11. The risk implications are severe, as arbitrary code execution under the security context of the application or system can lead to full host compromise, unauthorized data access, and lateral movement within the network. Exploitation requires the attacker to be in a network position capable of intercepting, altering, or spoofing DNS responses destined for the targeted client running the vulnerable software. No elevated privileges or prior authentication are required to initiate the attack vector.",
  "technicalDetails": "The vulnerability stems from a classic buffer overflow condition, specifically a buffer copy without bounds checking (CWE-120), located within the DNS response handling routines of FortiClientWindows. When the application parses incoming DNS responses, it fails to adequately validate the length of the data fields against the allocated destination buffer size in memory. This architectural weakness allows oversized input payloads to overwrite adjacent memory regions, including the stack or heap frames, corrupting critical control data such as saved frame pointers and return addresses.\nThe attack flow proceeds as follows: First, the attacker establishes a network position capable of manipulating name resolution traffic directed from the targeted host running FortiClientWindows. This can be achieved through techniques such as DNS spoofing, cache poisoning, or adversarial control over an upstream local network gateway or DNS server. Second, the attacker induces or waits for the targeted FortiClientWindows instance to initiate a DNS query. Third, the attacker crafts a malicious DNS response containing an oversized, specially formulated payload designed to exceed the predetermined boundaries of the vulnerable input buffer within the parsing component.\nUpon receiving the malicious DNS response, the vulnerable FortiClientWindows component processes the oversized data without performing adequate size verification. As the data is copied into the memory buffer, a memory corruption event occurs, overwriting adjacent memory structures. By carefully engineering the contents of the malicious DNS payload, an attacker can overwrite the instruction pointer with the address of malicious shellcode embedded within the buffer or leverage return-oriented programming (ROP) chains to bypass modern exploit mitigations such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).\nOnce execution control is successfully hijacked, the injected payload executes arbitrary code with the privileges of the running FortiClientWindows process. Depending on the operational context of the vulnerable service or application component, this may grant the attacker SYSTEM-level or administrative code execution capabilities on the host operating system. The vulnerability requires zero authentication and no prior privileges, making network proximity or man-in-the-middle positioning relative to the DNS query path the primary prerequisite for exploitation."
}