# CVE-2025-32756: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

- Exploited (CISA KEV): yes, added 2025-05-14
- Published: 2025-05-13
- CVSS: 9.6 CRITICAL (v3.1)
- EPSS: 30.9% (98th percentile)
- CWE: CWE-121

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-06-09 | 27 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-06-30 | 48 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-06-09 · new · rule 4f219ac0be3545a5be5f0bf34df8857a · default Block
  > Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-06-09-waf-release/
- 2025-07-07 · new · rule 58fcf6d9c05d4b7a8f41e0a3c329aeb0 · default Disabled
  > Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756. Previous action: Log. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-07-07-waf-release/

### F5

- 2025-06-30 · new · rule 200011104
  > Added: signature 200011104 "Fortinet Products Buffer Overflow" (Buffer Overflow, risk High), systems: Other Web Server. References: CVE-2025-32756.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-32756 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-32756