Description

A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-08-12T13:17:25.497Z",
  "pubdate": "2026-08-12T13:17:25.497Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability, designated as CWE-121, has been identified in Fortinet FortiOS versions 7.6.1 through 7.6.6.\nThe vulnerability allows an unauthenticated attacker to achieve arbitrary code or command execution within the execution context of the WAD daemon.\nSuccessful exploitation requires the explicit proxy configuration to have both Kerberos authentication and SOCKS enabled, along with the ability to bypass stack protection and ASLR mechanisms.\nThe risk implication is severe, as it permits unauthorized remote code execution on affected security appliances via crafted network sockets, potentially compromising the integrity and confidentiality of the underlying system.",
  "technicalDetails": "The vulnerability stems from a stack-based buffer overflow [CWE-121] residing within the WAD daemon of Fortinet FortiOS.\nAffected versions include Fortinet FortiOS 7.6.1 through 7.6.6.\nThe flaw is triggered when the explicit proxy feature is specifically configured with Kerberos authentication and SOCKS enabled, exposing vulnerable socket handling routines to incoming network traffic.\nAn unauthenticated attacker can supply crafted network sockets containing malicious payloads designed to exceed the bounds of allocated stack buffers within the vulnerable component.\nTo achieve successful exploitation, the attacker must possess the capability to bypass modern binary protection mechanisms such as stack protection and Address Space Layout Randomization (ASLR).\nUpon successful transmission of the crafted payload, the overflow overwrites adjacent stack memory, enabling the manipulation of control flow or execution vectors.\nExecution of arbitrary code or commands occurs directly within the execution context of the WAD daemon, granting the attacker privileges associated with that process.\nThe attack flow relies on network exposure of the explicit proxy service, allowing remote injection of malicious data streams that are improperly bounded during processing."
}