CVE-2026-70465: FortiClient Buffer Overflow Vulnerability

CVE-2026-70465 Overview

CVE-2026-70465 is a classic buffer overflow [CWE-120] affecting Fortinet FortiClientWindows. The flaw resides in how the client processes DNS responses, copying input into a buffer without validating its size. An unauthenticated attacker positioned to alter or craft DNS responses to the targeted host can trigger the overflow with malicious packets, leading to arbitrary code execution on the endpoint.

Critical Impact
A network-adjacent attacker capable of manipulating DNS traffic can achieve remote code execution on affected FortiClientWindows installations without authentication or user interaction.

Affected Products

Fortinet FortiClientWindows 7.4.0 through 7.4.3
Fortinet FortiClientWindows 7.2.0 through 7.2.11
Windows endpoints running vulnerable FortiClient versions

Discovery Timeline

2026-08-12 - CVE-2026-70465 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database
Vendor advisory - Fortinet published FG-IR-26-156

Technical Details for CVE-2026-70465

Vulnerability Analysis

The vulnerability is a classic buffer overflow in the DNS response handling code path of FortiClientWindows. The client copies data from inbound DNS responses into a fixed-size buffer without checking the length of the input against the buffer capacity. When crafted DNS response fields exceed the expected size, adjacent memory is overwritten. This condition permits an attacker to corrupt program state and redirect execution flow.

Exploitation requires the attacker to occupy a network position that allows altering or crafting DNS responses reaching the targeted host. Suitable positions include on-path adversaries, compromised upstream resolvers, rogue Wi-Fi networks, and attackers with control of local segments capable of spoofing DNS traffic. No authentication or user interaction is required.

Successful exploitation results in arbitrary code execution in the context of the FortiClient process. Depending on service privileges, this can grant SYSTEM-level control of the endpoint, enabling credential theft, persistence, and lateral movement into corporate networks protected by the affected client.

Root Cause

The root cause is the absence of bounds checking during a memory copy operation on attacker-controllable DNS response data. Input length is trusted implicitly rather than validated against the destination buffer size, matching the pattern described by CWE-120.

Attack Vector

The attack vector is network-based. An adversary intercepts or generates DNS responses directed at the FortiClient host and embeds an oversized payload in a field parsed by the vulnerable copy routine. The attack complexity is elevated because the attacker must reliably deliver the crafted response to the target and win any DNS transaction race conditions. No verified public proof-of-concept is available at the time of publication. Refer to the Fortinet Security Advisory FG-IR-26-156 for technical details.

Detection Methods for CVE-2026-70465

Indicators of Compromise

Unexpected crashes or restarts of FortiClient.exe or associated service processes following DNS activity
Anomalous child processes spawned by FortiClient components after resolving external hostnames
Malformed DNS response packets containing oversized answer, name, or resource record fields directed at Windows endpoints running FortiClient
Outbound connections from FortiClient processes to non-Fortinet infrastructure shortly after DNS resolution events

Detection Strategies

Monitor endpoint telemetry for process crashes and exception events originating in FortiClient binaries, particularly following network activity
Inspect DNS traffic at the perimeter and internal resolvers for responses containing oversized labels or malformed record structures
Correlate DNS query and response pairs with subsequent process behavior on endpoints to identify exploitation patterns
Alert on unsigned or unexpected code execution originating from the FortiClient process tree

Monitoring Recommendations

Enable DNS query logging on internal resolvers and forward events to a centralized analytics platform for anomaly detection
Track versions of FortiClientWindows deployed across managed endpoints to identify systems in the vulnerable range
Monitor for use of untrusted networks by endpoints running vulnerable FortiClient versions, where DNS spoofing risk is highest
Baseline normal FortiClient process behavior and alert on deviations such as memory access violations or unexpected module loads

How to Mitigate CVE-2026-70465

Immediate Actions Required

Inventory all Windows endpoints running FortiClientWindows and identify installations in the 7.4.0–7.4.3 or 7.2.0–7.2.11 version ranges
Apply the fixed FortiClientWindows release as specified in FG-IR-26-156 as soon as possible
Restrict endpoints to trusted DNS resolvers and block untrusted DNS traffic at the network boundary
Prioritize patching for mobile and remote users who frequently connect to untrusted networks

Patch Information

Fortinet has published advisory FG-IR-26-156 with upgrade guidance. Administrators should upgrade FortiClientWindows to a fixed release above the affected 7.4.x and 7.2.x branches. Review the advisory for the exact fixed version numbers before deployment.

Workarounds

Configure endpoints to use DNS over HTTPS (DoH) or DNS over TLS (DoT) with a trusted provider to reduce exposure to on-path DNS manipulation
Enforce use of corporate VPN tunnels that carry DNS traffic through authenticated, encrypted channels
Deploy DNSSEC validation on internal resolvers to detect tampering with DNS responses
Restrict outbound UDP port 53 from endpoints to approved resolvers only

bash

# Example: enforce use of specific DNS servers on Windows endpoints
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("10.0.0.53","10.0.0.54")

# Verify installed FortiClient version
Get-ItemProperty "HKLM:\SOFTWARE\Fortinet\FortiClient\FA_UI" | Select-Object Version