Heap-based buffer overflow in cw_acd daemon Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-25-084 Final 1 1 2026-01-13T00:00:00 Current version 2026-01-13T00:00:00 2026-02-23T00:00:00 A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiSwitchManager cw_acd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.The presence of security controls such as ASLR and PIE considerably raises the complexity and preparation effort required for exploitation. None Execute unauthorized code or commands None Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team. FortiOS 7.6.3 FortiOS 7.6.2 FortiOS 7.6.1 FortiOS 7.6.0 FortiOS 7.4.8 FortiOS 7.4.7 FortiOS 7.4.6 FortiOS 7.4.5 FortiOS 7.4.4 FortiOS 7.4.3 FortiOS 7.4.2 FortiOS 7.4.1 FortiOS 7.4.0 FortiOS 7.2.11 FortiOS 7.2.10 FortiOS 7.2.9 FortiOS 7.2.8 FortiOS 7.2.7 FortiOS 7.2.6 FortiOS 7.2.5 FortiOS 7.2.4 FortiOS 7.2.3 FortiOS 7.2.2 FortiOS 7.2.1 FortiOS 7.2.0 FortiOS 7.0.17 FortiOS 7.0.16 FortiOS 7.0.15 FortiOS 7.0.14 FortiOS 7.0.13 FortiOS 7.0.12 FortiOS 7.0.11 FortiOS 7.0.10 FortiOS 7.0.9 FortiOS 7.0.8 FortiOS 7.0.7 FortiOS 7.0.6 FortiOS 7.0.5 FortiOS 7.0.4 FortiOS 7.0.3 FortiOS 7.0.2 FortiOS 7.0.1 FortiOS 7.0.0 FortiOS 6.4.16 FortiOS 6.4.15 FortiOS 6.4.14 FortiOS 6.4.13 FortiOS 6.4.12 FortiOS 6.4.11 FortiOS 6.4.10 FortiOS 6.4.9 FortiOS 6.4.8 FortiOS 6.4.7 FortiOS 6.4.6 FortiOS 6.4.5 FortiOS 6.4.4 FortiOS 6.4.3 FortiOS 6.4.2 FortiOS 6.4.1 FortiOS 6.4.0 FortiSwitchManager 7.2.6 FortiSwitchManager 7.2.5 FortiSwitchManager 7.2.4 FortiSwitchManager 7.2.3 FortiSwitchManager 7.2.2 FortiSwitchManager 7.2.1 FortiSwitchManager 7.2.0 FortiSwitchManager 7.0.5 FortiSwitchManager 7.0.4 FortiSwitchManager 7.0.3 FortiSwitchManager 7.0.2 FortiSwitchManager 7.0.1 FortiSwitchManager 7.0.0 CVE-2025-25249 FortiOS-7.6.3 FortiOS-7.6.2 FortiOS-7.6.1 FortiOS-7.6.0 FortiOS-7.4.8 FortiOS-7.4.7 FortiOS-7.4.6 FortiOS-7.4.5 FortiOS-7.4.4 FortiOS-7.4.3 FortiOS-7.4.2 FortiOS-7.4.1 FortiOS-7.4.0 FortiOS-7.2.11 FortiOS-7.2.10 FortiOS-7.2.9 FortiOS-7.2.8 FortiOS-7.2.7 FortiOS-7.2.6 FortiOS-7.2.5 FortiOS-7.2.4 FortiOS-7.2.3 FortiOS-7.2.2 FortiOS-7.2.1 FortiOS-7.2.0 FortiOS-7.0.17 FortiOS-7.0.16 FortiOS-7.0.15 FortiOS-7.0.14 FortiOS-7.0.13 FortiOS-7.0.12 FortiOS-7.0.11 FortiOS-7.0.10 FortiOS-7.0.9 FortiOS-7.0.8 FortiOS-7.0.7 FortiOS-7.0.6 FortiOS-7.0.5 FortiOS-7.0.4 FortiOS-7.0.3 FortiOS-7.0.2 FortiOS-7.0.1 FortiOS-7.0.0 FortiOS-6.4.16 FortiOS-6.4.15 FortiOS-6.4.14 FortiOS-6.4.13 FortiOS-6.4.12 FortiOS-6.4.11 FortiOS-6.4.10 FortiOS-6.4.9 FortiOS-6.4.8 FortiOS-6.4.7 FortiOS-6.4.6 FortiOS-6.4.5 FortiOS-6.4.4 FortiOS-6.4.3 FortiOS-6.4.2 FortiOS-6.4.1 FortiOS-6.4.0 FortiSwitchManager-7.2.6 FortiSwitchManager-7.2.5 FortiSwitchManager-7.2.4 FortiSwitchManager-7.2.3 FortiSwitchManager-7.2.2 FortiSwitchManager-7.2.1 FortiSwitchManager-7.2.0 FortiSwitchManager-7.0.5 FortiSwitchManager-7.0.4 FortiSwitchManager-7.0.3 FortiSwitchManager-7.0.2 FortiSwitchManager-7.0.1 FortiSwitchManager-7.0.0 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-25-084 Heap-based buffer overflow in cw_acd daemon Reference>