{"id":"CVE-2025-32756","aliases":["EUVD-2025-14705","GHSA-fcpx-h44g-vx2x"],"status":"published","title":"A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0...","description":"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.30944,"percentile":0.98282,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-121","CWE-124","CWE-787"],"published":"2025-05-13T14:46:44Z","modified":"2026-06-17T09:12:32Z","kev":{"date_added":"2025-05-14","due_date":"2025-06-04","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-05-14"},{"source":"kev","since":"2025-05-14"}],"exploits":[{"source":"pocgithub","id":"exfil0/CVE-2025-32756-POC","title":"exfil0/CVE-2025-32756-POC","date":"2025-05-18","url":"https://github.com/exfil0/CVE-2025-32756-POC"},{"source":"pocgithub","id":"kn0x0x/CVE-2025-32756-POC","title":"kn0x0x/CVE-2025-32756-POC","date":"2025-06-05","url":"https://github.com/kn0x0x/CVE-2025-32756-POC"},{"source":"pocgithub","id":"alm6no5/CVE-2025-32756-POC","title":"alm6no5/CVE-2025-32756-POC","date":"2025-06-09","url":"https://github.com/alm6no5/CVE-2025-32756-POC"},{"source":"pocgithub","id":"becrevex/CVE-2025-32756","title":"becrevex/CVE-2025-32756","date":"2025-06-09","url":"https://github.com/becrevex/CVE-2025-32756"},{"source":"pocgithub","id":"shan0ar/cve-2025-32756","title":"shan0ar/cve-2025-32756","date":"2025-07-23","url":"https://github.com/shan0ar/cve-2025-32756"}],"products":[{"vendor":"fortinet","product":"forticamera"},{"vendor":"fortinet","product":"forticamera_firmware"},{"vendor":"fortinet","product":"fortimail"},{"vendor":"fortinet","product":"fortindr"},{"vendor":"fortinet","product":"fortirecorder"},{"vendor":"fortinet","product":"fortivoice"},{"vendor":"fortinet","product":"multiple products"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-254","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32756"},{"url":"https://github.com/advisories/GHSA-fcpx-h44g-vx2x"}],"sources":{"cve":[{"id":"CVE-2025-32756","description":"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.","status":"published","published":"2025-05-13T14:46:44.208Z","modified":"2026-02-26T18:28:36.454Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-14705","description":"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.","status":"published","published":"2025-05-13T14:46:44Z","modified":"2026-02-26T18:28:36Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C","level":"critical"}],"exploited_since":"2025-05-14","updated_at":"2026-11-02T19:48:16.990344Z"}],"ghsa":[{"id":"GHSA-fcpx-h44g-vx2x","title":"A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0...","description":"A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.8, FortiNDR versions 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.4, 7.0.0 through 7.0.6, FortiCamera versions 2.1.0 through 2.1.3, 2.0 all versions, 1.1 all versions, allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.","status":"published","published":"2025-05-13T15:32:16Z","modified":"2025-10-22T00:34:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2025-32756","title":"Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability","description":"Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.","cwes":["CWE-124"],"kev":{"date_added":"2025-05-14","due_date":"2025-06-04","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-32756","description":"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.","status":"published","published":"2025-05-13T15:15:57.113Z","modified":"2026-06-17T09:12:32.723Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:11:07.176032Z"}]}}