CVEvulnerability

CVE-2021-26109

9.8 CRITICAL Published 2021-12-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-12-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-190

Description

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution.

Affected configurations

• fortinet fortios (>= 6.0.0 <= 6.0.12) • fortinet fortios (>= 6.2.0 <= 6.2.9) • fortinet fortios (>= 6.4.0 <= 6.4.5) • fortinet fortios 7.0.0

Related

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References