VULNERABILITY INTELLIGENCE

CVE-2025-25249

CVSS score8.1 HIGH

EPSS probability3.74%

CISA KEVKnown exploited vulnerability

Published2026-01-13

Last modified2026-10-07

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Vendor / product: Fortinet / Multiple Products

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Weakness classification

psirt@fortinet.com: CWE-122
nvd@nist.gov: CWE-787

Primary references

psirt@fortinet.com — Mitigation, Vendor Advisory
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource