FortiClientWindows contains a classic buffer overflow flaw caused by an unchecked memory copy operation. This vulnerability allows an attacker to embed oversized data into a buffer during DNS response processing, which can lead to arbitrary code execution in the context of the FortiClient service. Because the flaw is triggered by malformed DNS packets, an unauthenticated attacker can potentially exploit the host simply by sending crafted DNS replies, enabling the attacker to run malicious code, exfiltrate data, or disrupt network operations.

Fortinet FortiClientWindows versions 7.2.0 through 7.2.11 and 7.4.0 through 7.4.3 are impacted. The weakness resides in the core network component that parses DNS responses. All installations of these releases running on Windows machines in corporate environments are potentially susceptible unless patched.

The CVSS score of 7.3 classifies this flaw as High severity. The lack of authentication requirement and network‑based attack vector mean that any external host capable of reaching the affected client can issue the malicious DNS requests needed to trigger the overflow. EPSS data are unavailable, so exact exploitation probability is unknown; however, the high score and potential for bypassing normal firewall rules underline the need for prompt remediation. The vulnerability is not yet listed in CISA’s KEV catalog, suggesting no publicly confirmed exploits at this time, but the risk remains significant.