Stack buffer overflow in WAD

{
  "id": "dd2a219ddfef490076a4a820d238e7865a29b467f4dfe9f1194f1536f75a1848",
  "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-161",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "Stack buffer overflow in WAD",
    "summary": "An unauthenticated attacker may execute arbitrary code or commands in the WAD daemon under the stated proxy configuration. FortiOS 7.6.1 through 7.6.6 are affected; upgrade to 7.6.7 or above. Disabling SOCKS proxy or avoiding Kerberos authentication for the SOCKS proxy are listed mitigations.",
    "evidence": "A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS explicit proxy may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.",
    "products": [
      {
        "name": {
          "value": "FortiOS",
          "evidence": "FortiOS 7.6"
        },
        "prerequisites": [
          {
            "value": "only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled",
            "evidence": "only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled"
          }
        ],
        "fixed_versions": [
          {
            "value": "7.6.7 or above",
            "evidence": "FortiOS 7.6 7.6.1 through 7.6.6 Upgrade to 7.6.7 or above"
          }
        ],
        "affected_versions": [
          {
            "value": "7.6.1 through 7.6.6",
            "evidence": "FortiOS 7.6 7.6.1 through 7.6.6 Upgrade to 7.6.7 or above"
          }
        ]
      }
    ],
    "severity": "medium",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-71407",
        "evidence": "CVE ID CVE-2026-71407"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity Medium"
  },
  "source_id": "official-fortinet-psirt",
  "document_id": 23579,
  "published_at": "2026-08-12T07:00:00+00:00"
}