SB20260813101 - Stack-based buffer overflow in FortiOS
Published: August 13, 2026
Security Bulletin ID
SB20260813101
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Stack-based buffer overflow (CVE-ID: CVE-2026-71407)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to stack-based buffer overflow in WAD. An unauthenticated attacker who can bypass stack protection and aslr can execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
Remediation
Install update from vendor's website.