FortiClient Windows Vulnerability Allows Code Execution via Malicious DNS Responses
A heap overflow vulnerability in FortiClient Windows, assigned CVSSv3 score 7.3, enables unauthenticated attackers to execute arbitrary code by manipulating DNS responses.
Fortinet has disclosed a critical heap overflow vulnerability affecting FortiClient for Windows, identified as a buffer copy without checking the size of the input flaw (CWE-120). This vulnerability, tracked under advisory FG-IR-26-156, carries a CVSSv3 score of 7.3 and could allow an unauthenticated attacker to execute arbitrary code on a targeted system.
The exploit mechanism relies on the attacker's ability to intercept or craft DNS responses sent to the vulnerable FortiClient instance. By sending a specially malformed DNS response, an attacker can trigger a heap overflow condition within the kernel driver. This overflow occurs because the software fails to adequately validate the size of data being copied into a buffer, allowing crafted input to exceed the buffer's boundaries and overwrite adjacent memory.
Successful exploitation of this vulnerability could lead to arbitrary code execution, granting the attacker the same level of privileges as the vulnerable FortiClient process. Given that FortiClient often operates with elevated privileges to manage network access and security policies, this could have significant implications for system compromise. The vulnerability specifically impacts versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11 of FortiClient for Windows.
Fortinet has provided specific upgrade paths to mitigate this risk. Users running affected versions of FortiClient Windows 7.4 are advised to upgrade to version 7.4.4 or later. Similarly, users on FortiClient Windows 7.2 should upgrade to version 7.2.12 or later. These updates are expected to contain the necessary fixes to address the missing size validation and prevent the heap overflow.
For environments where immediate upgrades are not feasible, Fortinet has also outlined a potential workaround. Administrators can disable application-based filtering within the FortiClient EMS VPN configuration. This is achieved by navigating to the Remote Access Profile, then VPN Tunnel, and toggling off the 'Application Based' setting. While this may mitigate the risk, it could also impact the functionality of application-aware routing or policy enforcement.
The vulnerability was responsibly disclosed to Fortinet by Nir Chako from Pentera, highlighting the ongoing collaboration between security researchers and vendors in identifying and addressing software flaws. The timeline indicates that the initial publication of this advisory occurred on August 12, 2026.
This discovery underscores the persistent threat posed by memory corruption vulnerabilities, particularly in kernel-level components where the impact of exploitation can be severe. The reliance on DNS responses as an attack vector also points to the importance of securing network communications and validating all incoming data, even from seemingly trusted protocols.
Organizations utilizing FortiClient are strongly encouraged to review the advisory and apply the recommended updates or implement the provided workaround as soon as possible to protect their endpoints from potential compromise.