An out-of-bounds write vulnerability exists in Fortinet FortiOS firmware, allowing an attacker to corrupt memory and execute arbitrary code by sending specially crafted packets. The flaw can be escalated to general code execution or command injection on the device, compromising confidentiality, integrity, and availability of the affected network appliance. This vulnerability is classified as a buffer overflow, corresponding to CWE‑787.

The issue affects FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.11 on Fortinet devices. The affected products are the core FortiOS firmware as well as integrated FortiSwitchManager and FortiEdgeCloud and FortiSASE components in the specified version ranges. Systems running any of these firmware releases are vulnerable until a patch is applied.

The CVSS score of 8.3 indicates a high severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires network access, as the attacker must deliver malformed packets to the device; therefore, the likely attack vector is remote network. The need for a patched image is clear to mitigate the risk.