CVE-2025-32756

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Fortinet	FortiNDR	7.6.0; >= 7.4.0, <= 7.4.7; >= 7.2.0, <= 7.2.4; >= 7.1.0, <= 7.1.1; >= 7.0.0, <= 7.0.6; >= 1.5.0, <= 1.5.3; 1.4.0; >= 1.3.0, <= 1.3.1; 1.2.0; 1.1.0
Fortinet	FortiCamera	>= 2.1.0, <= 2.1.3; 2.0.0; >= 1.1.0, <= 1.1.5
Fortinet	FortiRecorder	>= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.5; >= 6.4.0, <= 6.4.5
Fortinet	FortiVoice	7.2.0; >= 7.0.0, <= 7.0.6; >= 6.4.0, <= 6.4.10
Fortinet	FortiMail	>= 7.6.0, <= 7.6.2; >= 7.4.0, <= 7.4.4; >= 7.2.0, <= 7.2.7; >= 7.0.0, <= 7.0.8

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-254Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756US Government Resource

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: May 14, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-32765.4The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block CVE-2025-327666.7A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privile CVE-2025-32779.8An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer.CVE-2025-327765.5OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specia CVE-2025-327778.2Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12 CVE-2025-327789.3Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web C CVE-2025-327796.5E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with ac CVE-2025-32789.8The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to th CVE-2025-327807.3BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijackin CVE-2025-327816.5Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Po CVE-2025-327825.3Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request tr CVE-2025-327834.3XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wi