CVE-2022-42475: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Vulnerability summary

CVE-2022-42475 is a critical (CVSS 9.8) Numeric Truncation Error vulnerability in Fortinet FortiOS. It is known to be exploited: CISA lists it, first on 13-12-2022. It has been used in ransomware campaigns. EPSS estimates a 99.47% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-12-2022
   Added to CISA KEVFortinet FortiOS Heap-Based Buffer Overflow Vulnerability
2. 02-01-2023
   PublishedVulnerability first disclosed.
3. 03-01-2023
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

• CWE-197Numeric Truncation ErrorTruncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.