CVE-2025-32756
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Description
CVE-2025-32756 is a critical-severity stack-based buffer overflow vulnerability affecting multiple Fortinet products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. The flaw allows a remote unauthenticated attacker to execute arbitrary code or commands by sending HTTP requests with specially crafted hash cookies to the affected devices. With a CVSS v3.1 base score of 9.8, this vulnerability represents the highest risk level with trivial exploitation requirements. CISA has added CVE-2025-32756 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 4, 2025, and its EPSS score of 33.12% at the 96th percentile confirms a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortimail | >= 7.0.0, < 7.0.9; >= 7.2.0, < 7.2.8; >= 7.4.0, < 7.4.5; >= 7.6.0, < 7.6.3 |
| fortinet | fortindr | >= 7.0.0, < 7.0.7; >= 7.2.0, < 7.2.5; >= 7.4.0, < 7.4.8; 1.1.0; 1.2.0; 1.3.0; 1.4.0; 1.5.0; 7.1.0; 7.1.1; 7.6.0 |
| fortinet | fortirecorder | >= 6.4.0, < 6.4.6; >= 7.0.0, < 7.0.6; >= 7.2.0, < 7.2.4 |
| fortinet | fortivoice | >= 6.4.0, < 6.4.11; >= 7.0.0, < 7.0.7; 7.2.0 |
| fortinet | forticamera firmware | >= 2.0.0, <= 2.1.3; >= 1.1.0, <= 1.1.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-254(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
CVE-2025-32756 is classified under CWE-121, Stack-based Buffer Overflow. In the affected Fortinet products, the HTTP request handler allocates a fixed-size buffer on the stack for processing hash cookie values. When an attacker sends a specially crafted cookie that exceeds this buffer's size, the overflow overwrites adjacent stack data including saved return addresses and frame pointers. This enables the attacker to hijack program execution flow and redirect it to attacker-controlled code, achieving remote code execution.
Learn more: CWE-121 — Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write
This vulnerability also falls under CWE-787, Out-of-bounds Write, as the buffer overflow results in writing data beyond the allocated memory boundaries. The out-of-bounds write corrupts adjacent stack memory, which in the context of a stack-based buffer overflow enables precise control over program execution through return address manipulation.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2025-32756 carries a CVSS v3.1 base score of 9.8 (Critical), the highest practical severity rating, with a network-accessible attack vector (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), reflecting complete system compromise. The breadth of affected products is exceptional: FortiVoice (enterprise VoIP), FortiMail (email security), FortiNDR (network detection and response), FortiRecorder (video surveillance), and FortiCamera (surveillance cameras). This means a single vulnerability can be used to compromise multiple critical infrastructure components within a Fortinet-deployed environment. The EPSS score of 33.12% at the 96th percentile indicates this vulnerability is among the most actively targeted. Network security appliances like FortiMail and FortiNDR process untrusted traffic by design, making the attack surface directly internet-facing in many deployments.
Exploit Maturity
CVE-2025-32756 demonstrates high exploit maturity. CISA has confirmed active exploitation in the wild by adding it to the Known Exploited Vulnerabilities catalog. Fortinet has published a security advisory (FG-IR-25-254) acknowledging the vulnerability. The EPSS score of 33.12% at the 96th percentile indicates a very high probability of exploitation. Fortinet products are prime targets for threat actors due to their position as network perimeter devices, and the combination of pre-authentication exploitation, multiple affected products, and the trivial attack complexity makes this vulnerability highly attractive for both opportunistic scanning and targeted attacks. While CISA classifies the ransomware association as unknown, the complete system compromise achievable through this buffer overflow is fully compatible with ransomware deployment scenarios.
Remediation
- Apply Fortinet patches immediately. Upgrade all affected products to patched versions: FortiMail to 7.0.9, 7.2.8, 7.4.5, or 7.6.3+; FortiNDR to 7.0.7, 7.2.5, or 7.4.8+; FortiRecorder to 6.4.6, 7.0.6, or 7.2.4+; FortiVoice to 6.4.11, 7.0.7, or a version beyond 7.2.0; FortiCamera to a version beyond 2.1.3. Refer to the Fortinet advisory FG-IR-25-254 for exact version guidance.
- Restrict HTTP/HTTPS access. Disable management access from untrusted networks. If the devices must accept HTTP traffic from the internet (as is common for FortiMail), deploy a reverse proxy or WAF in front of the device to inspect and filter malicious hash cookie values.
- Conduct forensic investigation. Examine device logs for anomalous HTTP requests with unusually long or malformed cookie headers. Check for signs of compromise including unexpected configuration changes, new administrative accounts, or evidence of command execution.
- Implement network segmentation. Isolate Fortinet appliances from other critical infrastructure. Ensure that compromise of one device does not grant direct access to management interfaces of other Fortinet products or internal network resources.
- Enable intrusion detection signatures. Update IDS/IPS signatures to detect stack buffer overflow exploitation attempts targeting the hash cookie processing in Fortinet products. Monitor for outbound connections from Fortinet devices to unknown external hosts.
Technical Details
CVE-2025-32756 is a stack-based buffer overflow vulnerability in the HTTP request handling of multiple Fortinet products. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the most severe attack profile: network-accessible, no privileges required, no user interaction, low complexity, and maximum impact across all CIA dimensions.
The vulnerability exists in how the affected Fortinet products process hash cookie values in HTTP requests. A stack-allocated buffer is used to store the cookie data, but the application fails to validate the length of the cookie value before copying it into this buffer. When an attacker sends an HTTP request with a specially crafted, oversized hash cookie, the data overflows the stack buffer, corrupting adjacent memory including the function's saved return address. This is a combined CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write) vulnerability. By carefully crafting the overflow payload, an attacker can overwrite the return address to redirect execution to attacker-controlled code, achieving arbitrary code execution without authentication. The wide range of affected products (FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera) suggests the vulnerable code resides in a shared HTTP processing library used across Fortinet's product line.
Frequently Asked Questions
Is CVE-2025-32756 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-32756 to the KEV catalog. The EPSS score of 33.12% at the 96th percentile indicates a very high probability of exploitation. The critical severity and pre-authentication nature make this a prime target for attackers.
What products are affected by CVE-2025-32756?
Multiple Fortinet products are affected: FortiMail 7.0.0-7.0.8, 7.2.0-7.2.7, 7.4.0-7.4.4, 7.6.0-7.6.2; FortiNDR 7.0.0-7.0.6, 7.2.0-7.2.4, 7.4.0-7.4.7, and 7.6.0; FortiRecorder 6.4.0-6.4.5, 7.0.0-7.0.5, 7.2.0-7.2.3; FortiVoice 6.4.0-6.4.10, 7.0.0-7.0.6, 7.2.0; and FortiCamera 1.1.x through 2.1.3.
How do I fix CVE-2025-32756?
Upgrade all affected Fortinet products to the latest patched versions. For FortiMail, update to 7.0.9, 7.2.8, 7.4.5, or 7.6.3. Similar fixed versions exist for all affected products. Consult the Fortinet advisory FG-IR-25-254 for specific version guidance.
How severe is CVE-2025-32756?
CVE-2025-32756 has a CVSS v3.1 base score of 9.8 (Critical), the highest practical severity. It is remotely exploitable without authentication, requires no user interaction, and grants complete system compromise. The EPSS score of 33.12% at the 96th percentile confirms very high exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.