---
id: CVE-2025-22258
title: >-
  A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2,
  FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through
  1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through
  7.4.7,…
summary: >-
  A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2,
  FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through
  1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through
  7.4.7,…
severity: medium
cvss: 5.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:W/RC:R'
cvssSource: cna
cwe:
  - CWE-122
vendor: Fortinet
product: FortiPAM
affected:
  - FortiPAM 1.5.0
  - FortiPAM >= 1.4.0 <= 1.4.2
  - FortiPAM >= 1.3.0 <= 1.3.1
  - FortiPAM 1.2.0
  - FortiPAM >= 1.1.0 <= 1.1.2
  - FortiPAM >= 1.0.0 <= 1.0.3
  - FortiOS >= 7.6.0 <= 7.6.2
  - FortiOS >= 7.4.0 <= 7.4.6
  - FortiOS >= 7.2.0 <= 7.2.10
  - FortiOS >= 7.0.2 <= 7.0.16
  - FortiSRA 1.5.0
  - FortiSRA >= 1.4.0 <= 1.4.2
  - FortiProxy >= 7.6.0 <= 7.6.1
  - FortiProxy >= 7.4.0 <= 7.4.7
  - FortiSwitchManager >= 7.2.1 <= 7.2.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-10-17T03:55:17.613485Z'
published: '2025-10-14'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:02:55.275Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-22258'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-546'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-546'
tags:
  - cve.org
epss: 0.00556
epssPercentile: 0.46508
ingestedAt: '2026-11-05T20:33:06.542Z'
---

## Overview

A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests.

## Affected

- `FortiPAM 1.5.0`
- `FortiPAM >= 1.4.0 <= 1.4.2`
- `FortiPAM >= 1.3.0 <= 1.3.1`
- `FortiPAM 1.2.0`
- `FortiPAM >= 1.1.0 <= 1.1.2`
- `FortiPAM >= 1.0.0 <= 1.0.3`
- `FortiOS >= 7.6.0 <= 7.6.2`
- `FortiOS >= 7.4.0 <= 7.4.6`
- `FortiOS >= 7.2.0 <= 7.2.10`
- `FortiOS >= 7.0.2 <= 7.0.16`
- `FortiSRA 1.5.0`
- `FortiSRA >= 1.4.0 <= 1.4.2`
- `FortiProxy >= 7.6.0 <= 7.6.1`
- `FortiProxy >= 7.4.0 <= 7.4.7`
- `FortiSwitchManager >= 7.2.1 <= 7.2.5`

## Remediation

Upgrade to FortiPAM version 1.6.0 or above
Upgrade to FortiPAM version 1.5.1 or above
Upgrade to FortiPAM version 1.4.3 or above
Fortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.
Upgrade to FortiOS version 7.6.3 or above
Upgrade to FortiOS version 7.4.7 or above
Upgrade to FortiOS version 7.2.11 or above
Upgrade to FortiOS version 7.0.17 or above
Upgrade to FortiSRA version 1.6.0 or above
Upgrade to FortiSRA version 1.5.1 or above
Upgrade to FortiSRA version 1.4.3 or above
Upgrade to FortiProxy version 7.6.2 or above
Upgrade to FortiProxy version 7.4.8 or above
Upgrade to FortiSwitchManager version 7.2.6 or above