---
id: CVE-2025-58413
title: >-
  A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through
  7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all
  ver…
summary: >-
  A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through
  7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all
  ver…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C'
cvssSource: cna
cwe:
  - CWE-121
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS >= 7.6.0 <= 7.6.3
  - FortiOS >= 7.4.0 <= 7.4.8
  - FortiOS >= 7.2.0 <= 7.2.12
  - FortiOS >= 7.0.0 <= 7.0.18
  - FortiOS >= 6.4.0 <= 6.4.16
  - FortiOS >= 6.2.0 <= 6.2.17
  - FortiOS >= 6.0.0 <= 6.0.18
  - FortiSASE 25.3.b
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-11-19T04:55:34.277263Z'
published: '2025-11-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:09:22.629Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-58413'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-632'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-632'
tags:
  - cve.org
epss: 0.00319
epssPercentile: 0.23248
ingestedAt: '2026-10-15T05:52:46.068Z'
---

## Overview

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets

## Affected

- `FortiOS >= 7.6.0 <= 7.6.3`
- `FortiOS >= 7.4.0 <= 7.4.8`
- `FortiOS >= 7.2.0 <= 7.2.12`
- `FortiOS >= 7.0.0 <= 7.0.18`
- `FortiOS >= 6.4.0 <= 6.4.16`
- `FortiOS >= 6.2.0 <= 6.2.17`
- `FortiOS >= 6.0.0 <= 6.0.18`
- `FortiSASE 25.3.b`

## Remediation

Upgrade to FortiOS version 7.6.4 or above
Upgrade to FortiOS version 7.4.9 or above
Fortinet remediated this issue in FortiSASE version 25.3.c and hence customers do not need to perform any action.