CVE-2021-26109

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt…

High · published December 8, 2021

CVSS v3.1
8.1
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.01883 · 79.3th percentile
Published
2021-12-08T12:22Z
EPSS history
Timeline
  • 08 DEC 12:22Z
    An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt…
    cvelistv5