{"schemaVersion":3,"id":"CVE-2025-32756","aliases":[],"status":"published","duplicateOf":null,"title":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","description":"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.","dates":{"published":"2025-05-13T14:46:44.208Z","modified":"2026-02-26T18:28:36.454Z","reserved":null,"kevAdded":["2025-05-14T00:00:00.000Z"],"kevDue":["2025-06-04T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.6,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.30944,"percentile":0.9825,"severity":"high","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":1.1319999999999997,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.29812},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.30944,"percentile":0.9825}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.29812,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.30703,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.30944,"percentile":0.9825}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-05-14T00:00:00.000Z","dueDate":"2025-06-04T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","description":"Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.","notes":[{"type":"url","href":"https://fortiguard.fortinet.com/psirt/FG-IR-25-254","label":"fortiguard.fortinet.com/psirt/FG-IR-25-254"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-32756","label":"nvd.nist.gov/vuln/detail/CVE-2025-32756"}],"vendor":"Fortinet","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-05-14T00:00:00.000Z","dueDate":"2025-06-04T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","description":"Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.","notes":[{"type":"url","href":"https://fortiguard.fortinet.com/psirt/FG-IR-25-254","label":"fortiguard.fortinet.com/psirt/FG-IR-25-254"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-32756","label":"nvd.nist.gov/vuln/detail/CVE-2025-32756"}],"vendor":"Fortinet","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-121","name":"Stack-based Buffer Overflow","description":"A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/121.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"fortinet","product":"forticamera_firmware","name":"forticamera firmware","label":"forticamera_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.0, ≤ 2.1.3","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0, ≤ 2.1.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.1.0, ≤ 1.1.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, ≤ 2.1.3 | 2.0.0 | ≥ 2.0.0, ≤ 2.1.3 | ≥ 1.1.0, ≤ 1.1.5","eol":null,"hubHref":"/vendor/fortinet/forticamera"},{"vendor":"fortinet","product":"fortimail","name":"FortiMail","label":"fortimail","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.6.0, ≤ 7.6.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.0, ≤ 7.4.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, < 7.2.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.0, < 7.4.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.6.0, < 7.6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.6.0, ≤ 7.6.2 | ≥ 7.4.0, ≤ 7.4.4 | ≥ 7.2.0, ≤ 7.2.7 | ≥ 7.0.0, ≤ 7.0.8 | ≥ 7.0.0, < 7.0.9 | ≥ 7.2.0, < 7.2.8 | ≥ 7.4.0, < 7.4.5 | ≥ 7.6.0, < 7.6.3","eol":null,"hubHref":"/vendor/fortinet/fortimail"},{"vendor":"fortinet","product":"fortindr","name":"fortindr","label":"fortindr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.4.0, ≤ 7.4.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.1.0, ≤ 7.1.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.5.0, ≤ 1.5.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.3.0, ≤ 1.3.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, < 7.2.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.0, < 7.4.8","noFixRecorded":false,"fixedIn":null},{"text":"1.1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.2.0","noFixRecorded":false,"fixedIn":null},{"text":"1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"1.4.0","noFixRecorded":false,"fixedIn":null},{"text":"1.5.0","noFixRecorded":false,"fixedIn":null},{"text":"7.1.0","noFixRecorded":false,"fixedIn":null},{"text":"7.1.1","noFixRecorded":false,"fixedIn":null},{"text":"7.6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.4.0, ≤ 7.4.7 | ≥ 7.2.0, ≤ 7.2.4 | ≥ 7.1.0, ≤ 7.1.1 | ≥ 7.0.0, ≤ 7.0.6 | ≥ 1.5.0, ≤ 1.5.3 | ≥ 1.3.0, ≤ 1.3.1 | ≥ 7.0.0, < 7.0.7 | ≥ 7.2.0, < 7.2.5 | ≥ 7.4.0, < 7.4.8 | 1.1.0 | 1.2.0 | 1.3.0 | 1.4.0 | 1.5.0 | 7.1.0 | 7.1.1 | 7.6.0","eol":null,"hubHref":"/vendor/fortinet/fortindr"},{"vendor":"fortinet","product":"fortirecorder_firmware","name":"fortirecorder firmware","label":"fortirecorder_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 7.2.0, ≤ 7.2.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, < 6.4.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, < 7.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.2.0, ≤ 7.2.3 | ≥ 7.0.0, ≤ 7.0.5 | ≥ 6.4.0, ≤ 6.4.5 | ≥ 6.4.0, < 6.4.6 | ≥ 7.0.0, < 7.0.6 | ≥ 7.2.0, < 7.2.4","eol":null,"hubHref":"/vendor/fortinet/fortirecorder"},{"vendor":"fortinet","product":"fortivoice","name":"fortivoice","label":"fortivoice","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, ≤ 7.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, < 6.4.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.7","noFixRecorded":false,"fixedIn":null},{"text":"7.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, ≤ 7.0.6 | ≥ 6.4.0, ≤ 6.4.10 | ≥ 6.4.0, < 6.4.11 | ≥ 7.0.0, < 7.0.7 | 7.2.0","eol":null,"hubHref":"/vendor/fortinet/fortivoice"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-254","label":"fortiguard.fortinet.com/psirt/FG-IR-25-254","hostname":"fortiguard.fortinet.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-05-13T14:46:44.208Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-05-14T00:00:00.000Z","label":"Added to CISA KEV","detail":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-06-04T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-02-26T18:28:36.454Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T07:52:02.172Z","stale":false,"partial":false}}