Loading vulnerability…
Heap-Based Buffer Overflow in FortiClient Windows IPsec Driver
CVE-2025-46373 is a heap-based buffer overflow in the FortiClient Windows IPsec driver. It affects FortiClient Windows versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8. An authenticated local IPsec user may exploit the overflow to execute arbitrary code or commands, subject to bypassing Windows heap-integrity protections.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can provide authenticated local arbitrary code or command execution on the affected Windows system. Exploitation requires bypass of Windows heap-integrity protections.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting local access to trusted users only, limiting who can establish or use IPSec VPN functionality on affected endpoints, and monitoring for abnormal activity involving the FortiClient IPSec component. Because exploitation requires an authenticated local IPSec user and a bypass of Windows heap protections, enforcing least privilege, hardening endpoints, and using exploit-mitigation controls may reduce practical exploitability, but these measures are not substitutes for vendor patching.
Patch, then assume compromise.
Upgrade FortiClient Windows 7.4.0 through 7.4.3 to version 7.4.4 or later, and upgrade versions 7.2.0 through 7.2.8 to version 7.2.9 or later. For FortiClient Windows free VPN-Only version 7.4.3, apply hotfix 7.4.3.1761.1.8758 or upgrade to version 7.4.3.4726.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.