PSIRT Heap overflow in kernel driver due to missing size validation

{
  "id": "ca4f09645b87045d35780de0b83caaddb0b8d796eeeda89f794ef169777468bf",
  "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-156",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "PSIRT Heap overflow in kernel driver due to missing size validation",
    "summary": "FortiClient Windows contains a buffer-copy vulnerability that may allow an unauthenticated attacker to execute arbitrary code by crafting DNS responses. Fortinet provides upgrades and a workaround; FortiClient VPN-Only also has a stated resolved version.",
    "evidence": "A buffer copy without checking size of input vulnerability [CWE-120] in FortiClient Windows may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.",
    "products": [
      {
        "name": {
          "value": "FortiClientWindows",
          "evidence": "FortiClientWindows 7.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.4.4 or above",
            "evidence": "Upgrade to 7.4.4 or above"
          }
        ],
        "affected_versions": [
          {
            "value": "7.4.0 through 7.4.3",
            "evidence": "7.4.0 through 7.4.3"
          }
        ]
      },
      {
        "name": {
          "value": "FortiClientWindows",
          "evidence": "FortiClientWindows 7.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.2.12 or above",
            "evidence": "Upgrade to 7.2.12 or above"
          }
        ],
        "affected_versions": [
          {
            "value": "7.2.0 through 7.2.11",
            "evidence": "7.2.0 through 7.2.11"
          }
        ]
      },
      {
        "name": {
          "value": "FortiClient Windows",
          "evidence": "FortiClient Windows"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "FortiClient VPN-Only",
          "evidence": "FortiClient VPN-Only"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.4.3b6002",
            "evidence": "This issue has been resolved in FortiClient VPN-Only 7.4.3b6002"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-70465",
        "evidence": "CVE ID CVE-2026-70465"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity High"
  },
  "source_id": "official-fortinet-psirt",
  "document_id": 23577,
  "published_at": "2026-08-12T07:00:00+00:00"
}