CVE Watch31 jul 2026

CVE-2023-27997

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

CVSS

9.8

Crítico

EPSS

85.7%

p100

KEV

SÍ

13 jun 2023

Exploit Today

0-100

Publicado: 13 jun 2023 · Última mod.: 31 jul 2026 · CWE-122 · CWE-787

EPSS · 30d

85.7%EPSS · 30 días85.7%

2026-09-172026-10-15

Ficha del catálogo KEV

Producto

Fortinet / FortiOS and FortiProxy SSL-VPN

Vulnerabilidad

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

Añadido a KEV

13 jun 2023

Remediar antes de

4 jul 2023

Uso conocido en ransomware

Sí

Descripción resumida

Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

Acción requerida

Apply updates per vendor instructions.

Notas

https://www.fortiguard.com/psirt/FG-IR-23-097; https://nvd.nist.gov/vuln/detail/CVE-2023-27997

Descripción técnica

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-890625.5 MED

—

———A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.2h CVE-2026-1112807.4 ALT

—

———snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.4h CVE-2026-1112756.1 MED

—

———nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.4h CVE-2026-1112706.1 MED

—

———libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.4h CVE-2026-1084518.8 ALT

—

———Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.5h CVE-2026-1084508.8 ALT

—

———Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.5h