{"id":"CVE-2025-22258","title":"A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7,…","summary":"A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7,…","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:W/RC:R","cvssSource":"cna","cwe":["CWE-122"],"vendor":"Fortinet","product":"FortiPAM","affected":["FortiPAM 1.5.0","FortiPAM >= 1.4.0 <= 1.4.2","FortiPAM >= 1.3.0 <= 1.3.1","FortiPAM 1.2.0","FortiPAM >= 1.1.0 <= 1.1.2","FortiPAM >= 1.0.0 <= 1.0.3","FortiOS >= 7.6.0 <= 7.6.2","FortiOS >= 7.4.0 <= 7.4.6","FortiOS >= 7.2.0 <= 7.2.10","FortiOS >= 7.0.2 <= 7.0.16","FortiSRA 1.5.0","FortiSRA >= 1.4.0 <= 1.4.2","FortiProxy >= 7.6.0 <= 7.6.1","FortiProxy >= 7.4.0 <= 7.4.7","FortiSwitchManager >= 7.2.1 <= 7.2.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-10-17T03:55:17.613485Z"},"published":"2025-10-14","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:02:55.275Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-22258","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-546","label":"https://fortiguard.fortinet.com/psirt/FG-IR-24-546"}],"tags":["cve.org"],"epss":0.00556,"epssPercentile":0.46508,"ingestedAt":"2026-11-05T20:33:06.542Z","slug":"CVE-2025-22258","body":"## Overview\n\nA heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests.\n\n## Affected\n\n- `FortiPAM 1.5.0`\n- `FortiPAM >= 1.4.0 <= 1.4.2`\n- `FortiPAM >= 1.3.0 <= 1.3.1`\n- `FortiPAM 1.2.0`\n- `FortiPAM >= 1.1.0 <= 1.1.2`\n- `FortiPAM >= 1.0.0 <= 1.0.3`\n- `FortiOS >= 7.6.0 <= 7.6.2`\n- `FortiOS >= 7.4.0 <= 7.4.6`\n- `FortiOS >= 7.2.0 <= 7.2.10`\n- `FortiOS >= 7.0.2 <= 7.0.16`\n- `FortiSRA 1.5.0`\n- `FortiSRA >= 1.4.0 <= 1.4.2`\n- `FortiProxy >= 7.6.0 <= 7.6.1`\n- `FortiProxy >= 7.4.0 <= 7.4.7`\n- `FortiSwitchManager >= 7.2.1 <= 7.2.5`\n\n## Remediation\n\nUpgrade to FortiPAM version 1.6.0 or above\nUpgrade to FortiPAM version 1.5.1 or above\nUpgrade to FortiPAM version 1.4.3 or above\nFortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.\nUpgrade to FortiOS version 7.6.3 or above\nUpgrade to FortiOS version 7.4.7 or above\nUpgrade to FortiOS version 7.2.11 or above\nUpgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiSRA version 1.6.0 or above\nUpgrade to FortiSRA version 1.5.1 or above\nUpgrade to FortiSRA version 1.4.3 or above\nUpgrade to FortiProxy version 7.6.2 or above\nUpgrade to FortiProxy version 7.4.8 or above\nUpgrade to FortiSwitchManager version 7.2.6 or above","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}