---
id: CVE-2025-57740
title: >-
  An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2
  and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all
  versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below,
  1.3 all ver…
summary: >-
  An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2
  and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all
  versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below,
  1.3 all ver…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-122
vendor: Fortinet
product: FortiPAM
affected:
  - FortiPAM 1.5.0
  - FortiPAM >= 1.4.0 <= 1.4.2
  - FortiPAM >= 1.3.0 <= 1.3.1
  - FortiPAM 1.2.0
  - FortiPAM >= 1.1.0 <= 1.1.2
  - FortiPAM >= 1.0.0 <= 1.0.3
  - FortiProxy >= 7.6.0 <= 7.6.2
  - FortiProxy >= 7.4.0 <= 7.4.3
  - FortiProxy >= 7.2.0 <= 7.2.15
  - FortiProxy >= 7.0.0 <= 7.0.22
  - FortiOS >= 7.6.0 <= 7.6.2
  - FortiOS >= 7.4.0 <= 7.4.7
  - FortiOS >= 7.2.0 <= 7.2.10
  - FortiOS >= 7.0.0 <= 7.0.18
  - FortiOS >= 6.4.0 <= 6.4.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-10-16T03:57:11.609008Z'
published: '2025-10-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:09:21.447Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-57740'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-756'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-756'
tags:
  - cve.org
epss: 0.00681
epssPercentile: 0.51353
ingestedAt: '2026-10-15T05:52:46.069Z'
---

## Overview

An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.

## Affected

- `FortiPAM 1.5.0`
- `FortiPAM >= 1.4.0 <= 1.4.2`
- `FortiPAM >= 1.3.0 <= 1.3.1`
- `FortiPAM 1.2.0`
- `FortiPAM >= 1.1.0 <= 1.1.2`
- `FortiPAM >= 1.0.0 <= 1.0.3`
- `FortiProxy >= 7.6.0 <= 7.6.2`
- `FortiProxy >= 7.4.0 <= 7.4.3`
- `FortiProxy >= 7.2.0 <= 7.2.15`
- `FortiProxy >= 7.0.0 <= 7.0.22`
- `FortiOS >= 7.6.0 <= 7.6.2`
- `FortiOS >= 7.4.0 <= 7.4.7`
- `FortiOS >= 7.2.0 <= 7.2.10`
- `FortiOS >= 7.0.0 <= 7.0.18`
- `FortiOS >= 6.4.0 <= 6.4.16`

## Remediation

Upgrade to FortiPAM version 1.5.1 or above
Upgrade to FortiPAM version 1.4.3 or above
Upgrade to FortiProxy version 7.6.3 or above
Upgrade to FortiProxy version 7.4.4 or above
Upgrade to FortiOS version 7.6.3 or above
Upgrade to FortiOS version 7.4.8 or above
Upgrade to FortiOS version 7.2.11 or above
Upgrade to FortiSASE-Sovereign version 25.2 or above