CVE-2025-46373 Overview
CVE-2025-46373 is a heap-based buffer overflow [CWE-122] in the fortips_74.sys driver shipped with Fortinet FortiClientWindows. The vulnerability affects FortiClientWindows versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8. An authenticated local IPSec user can trigger the overflow to execute arbitrary code or commands on the host. Successful exploitation requires bypassing Windows heap integrity protections, which raises attack complexity but does not eliminate risk. Because fortips_74.sys is a kernel-mode driver, successful exploitation grants code execution at elevated privilege.
Critical Impact
Authenticated local attackers can execute arbitrary code through the FortiClient IPSec driver, achieving privilege escalation with high impact to confidentiality, integrity, and availability.
Affected Products
- Fortinet FortiClientWindows 7.4.0 through 7.4.3
- Fortinet FortiClientWindows 7.2.0 through 7.2.8
- Windows endpoints running the fortips_74.sys IPSec driver
Discovery Timeline
- 2025-11-18 - CVE-2025-46373 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46373
Vulnerability Analysis
The flaw resides in fortips_74.sys, the kernel-mode driver responsible for FortiClient IPSec functionality on Windows. A heap-based buffer overflow [CWE-122] occurs when the driver processes input from an authenticated local IPSec user without sufficient bounds validation on a heap-allocated buffer. Writing past the allocation corrupts adjacent kernel heap metadata or object structures, enabling arbitrary code execution in kernel context.
The attack requires local access and valid credentials, so the vulnerability primarily supports privilege escalation from a low-privileged user to SYSTEM. The changed scope indicates that a successful exploit affects resources beyond the driver's original security boundary, consistent with kernel compromise from user-mode input. Exploitation is non-trivial: the attacker must craft inputs that survive Windows heap integrity protections such as heap segment metadata validation and pool cookies.
Root Cause
The root cause is missing or insufficient length checking when copying attacker-controllable data into a heap-allocated buffer inside fortips_74.sys. The driver accepts IPSec-related input from user space and copies it into kernel memory without validating that the source length fits the destination allocation.
Attack Vector
An attacker who already holds an authenticated local session and is authorized to interact with the FortiClient IPSec interface sends crafted input to the driver. The malformed request drives the vulnerable code path in fortips_74.sys, overflowing the heap buffer. If the attacker successfully bypasses Windows heap integrity protections, the overwrite is shaped to hijack control flow and run attacker-supplied code in the kernel. Refer to the Fortinet Security Advisory FG-IR-25-125 for vendor technical details.
No public proof-of-concept is available. EPSS currently reflects low near-term exploitation probability.
Detection Methods for CVE-2025-46373
Indicators of Compromise
- Unexpected crashes, bugchecks, or kernel memory dumps referencing fortips_74.sys
- FortiClient service restarts or driver reload events without a corresponding administrative action
- New or unsigned processes spawning immediately after IPSec-related activity on an endpoint running vulnerable FortiClient builds
Detection Strategies
- Inventory endpoints for FortiClientWindows versions in the 7.4.0–7.4.3 and 7.2.0–7.2.8 ranges and flag them for remediation tracking.
- Alert on kernel-mode exceptions and pool corruption events (BugCheckCode 0x19, 0x1A, 0xC4) originating from fortips_74.sys.
- Correlate local logon events with subsequent privilege escalations to SYSTEM on hosts running vulnerable FortiClient builds.
Monitoring Recommendations
- Forward Windows kernel and WER crash telemetry to a centralized data lake for pattern analysis across the fleet.
- Monitor changes to FortiClient driver files and services, including load events for fortips_74.sys.
- Track local user activity that interacts with FortiClient IPSec configuration to establish a behavioral baseline.
How to Mitigate CVE-2025-46373
Immediate Actions Required
- Upgrade FortiClientWindows to a fixed release as directed in the Fortinet Security Advisory FG-IR-25-125.
- Restrict local logon rights on endpoints running FortiClient to trusted users only, reducing the pool of potential attackers.
- Audit which accounts are authorized to use FortiClient IPSec and remove entitlements that are not required.
Patch Information
Fortinet has published remediation guidance in advisory FG-IR-25-125. Administrators should upgrade to a FortiClientWindows build newer than 7.4.3 for the 7.4.x branch and newer than 7.2.8 for the 7.2.x branch, following the vendor's fixed-version matrix. Confirm the driver file fortips_74.sys reflects the patched version after installation.
Workarounds
- If patching cannot be completed immediately, limit interactive and remote local logon on FortiClient-enabled endpoints to reduce the authenticated attack surface.
- Disable the FortiClient IPSec component on endpoints where it is not operationally required until patched builds are deployed.
- Enforce application allowlisting and standard-user policies so unprivileged users cannot stage exploitation tooling.
# Verify installed FortiClient version and driver file on Windows
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\Fortinet\FortiClient\FA_VERSION' | Select-Object Version"
powershell -Command "Get-Item 'C:\Program Files\Fortinet\FortiClient\fortips_74.sys' | Select-Object FullName, VersionInfo"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
