CVE-2026-70465

Executive Summary

CVE-2026-70465 is a classic buffer overflow vulnerability (CWE-120) in Fortinet FortiClientWindows, affecting versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.11. An unauthenticated attacker capable of altering or crafting DNS responses destined for a target host may exploit this flaw to achieve remote code execution via malicious packets. The vulnerability carries a CVSS score of 8.1 (High), reflecting full compromise of confidentiality, integrity, and availability, tempered only by the attack complexity required to position a malicious DNS response. As of this report, no patch is available from any tracked source, and no public proof-of-concept or exploit code has been identified, though the vulnerability class is well-understood and actively targeted in adjacent products.

Technical Analysis

The vulnerability is identified as a "classic buffer overflow" categorized under CWE-120 (Buffer Copy without Checking Size of Input). This flaw class occurs when a program copies data into a fixed-size buffer without verifying that the source data length does not exceed the destination buffer capacity. In the context of FortiClientWindows, the vulnerable code path processes DNS responses received from the network. When the application parses or handles DNS response data, a fixed-size buffer is filled with response content without adequate bounds checking. A malicious DNS response containing data that exceeds the expected buffer size will cause adjacent memory to be overwritten.

The attack surface is the DNS resolution component of FortiClientWindows. FortiClient is a unified endpoint security agent that includes VPN, endpoint detection, web filtering, and other network security features. The DNS handling component is part of the client's network stack and is exposed to any DNS responses arriving at the host. Attackers do not need valid credentials (PR:N) and do not require user interaction (UI:N) — the vulnerability triggers automatically when the crafted DNS response is processed by the client.

The attack complexity is rated High (AC:H) under the CVSS vector. This rating reflects the practical difficulty of reliably redirecting or manipulating DNS queries from the targeted host. An attacker must control the DNS resolution path — either by operating a malicious DNS server the victim queries, performing DNS cache poisoning, or intercepting DNS traffic through on-path position (e.g., on a shared network segment). The lack of authentication and user interaction requirements, combined with the network-based attack vector (AV:N), means the only barrier is the attacker's ability to deliver a crafted DNS response to the target.

The buffer overflow likely resides in the parsing logic of DNS response records — such as resource record (RR) fields, name compression pointers, or TXT record data — where length fields from the wire protocol are trusted without validation. If the application copies DNS response payloads into stack- or heap-based buffers without checking declared lengths against actual buffer capacity, an attacker can control the overflow payload. Classic buffer overflow exploitation typically overwrites the return address on the stack (for stack-based overflows) or metadata structures (for heap-based overflows) to redirect execution to attacker-controlled shellcode.

No specific function names, class names, or file paths are disclosed in the NVD description. Fortinet has not released advisory-level technical details publicly. The code-level analysis above is inferred from the vulnerability class and the attack vector described — no implementation details are fabricated.

Exploitation Scenarios

The attack chain for CVE-2026-70465 proceeds as follows:

Step 1 — Reconnaissance/target identification. The attacker first identifies hosts running FortiClientWindows versions 7.4.0–7.4.3 or 7.2.0–7.2.11. This may be achieved via network scanning for FortiClient-related services, OSINT gathering on corporate endpoint management policies, or passive fingerprinting of the client's network behavior. The target must use DNS resolution that the attacker can influence — this includes networks with weak DNS security, hosts using default DNS settings on untrusted networks (e.g., public Wi-Fi), or environments where the attacker shares the broadcast domain.

Step 2 — Triggering the flaw class. The attacker positions themselves to deliver a crafted DNS response to the target. This is achieved through one of several methods: (a) operating a rogue DNS server that the victim is tricked or coerced into using (DHCP hijacking, VPN split-tunnel misconfiguration); (b) DNS cache poisoning (Kaminsky-style) to spoof responses to legitimate DNS queries; (c) on-path interception on a shared Ethernet/Wi-Fi segment using ARP spoofing combined with DNS response injection. Once positioned, the attacker receives the victim's DNS queries and responds with a specially crafted DNS packet that includes a malicious resource record or malformed length field exceeding the buffer size in FortiClientWindows' DNS parsing routine.

Step 3 — Payload/execution at vulnerability-class level. The crafted DNS response contains a payload designed to overflow the destination buffer. Given the classic overflow classification, the attacker likely overwrites a return address or function pointer on the stack/heap with a controlled value pointing to attacker-controlled data. This data may be embedded within the DNS response itself or staged in another memory region. Successful exploitation results in arbitrary code execution under the security context of the FortiClientWindows process — typically running with elevated privileges due to the endpoint agent's need to enforce security policies, install drivers, and manage VPN connections.

Step 4 — Post-exploitation impact. Once code execution is achieved, the attacker operates with the privileges of the FortiClientWindows service. On typical enterprise deployments, this is a local system or root-equivalent account, granting full control over the endpoint. The attacker can install persistence mechanisms, deploy additional malware (e.g., ransomware, keyloggers, remote access trojans), disable security controls that FortiClient would otherwise enforce, exfiltrate sensitive data, move laterally across the network using harvested credentials, and pivot to other systems. Because the vulnerability requires no user interaction, it is particularly dangerous in scenarios where the endpoint connects to untrusted networks before the corporate VPN establishes.

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description. The attacker-controlled DNS response is the sole delivery mechanism, and no other protocol or port exposure is required.

Impact Assessment

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 8.1, rated High. All three impact metrics — confidentiality, integrity, and availability — are rated High, indicating a complete compromise of the affected host. The unauthenticated and non-interactive nature of the attack (PR:N, UI:N) means any user on a network segment where the attacker can manipulate DNS responses is a potential victim. The scope is Unchanged (S:U), limiting the direct impact to the single affected host, though post-exploitation lateral movement expands the practical blast radius significantly.

Affected systems are FortiClientWindows deployments in the 7.4.0–7.4.3 and 7.2.0–7.2.11 version ranges. FortiClient is widely deployed in enterprise environments as an endpoint security agent, zero-trust access client, and VPN solution. Organizations relying on FortiClient for remote access and endpoint compliance are particularly exposed because these clients routinely operate on untrusted networks (home networks, hotels, public Wi-Fi) where DNS manipulation is feasible. The business impact includes potential data breach (intellectual property, credentials, regulated data), operational disruption from malware deployment, regulatory fines for non-compliance, and reputational damage.

The attack complexity (AC:H) provides the sole mitigating factor. Successful exploitation requires reliable DNS response injection, which is challenging on well-configured corporate networks using DNSSEC or encrypted DNS (DoH/DoT). However, on networks where DNS traffic is unauthenticated and visible (most legacy enterprise networks and virtually all public networks), the difficulty is substantially reduced. The lack of a CISA KEV listing indicates no confirmed in-the-wild exploitation at the time of writing, but the vulnerability class is historically weaponizable, and the lack of a patch elevates the urgency.

Detection Guidance

Sigma Rule

title: FortiClientWindows Malicious DNS Response Buffer Overflow Attempt
id: 97f4a2c1-8b3d-4e5f-9a6b-2c3d4e5f6a7b
status: experimental
description: Detects suspicious DNS responses that may trigger CVE-2026-70465 buffer overflow in FortiClientWindows
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70465
author: valtersit.com Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1562
    - attack.t1200
    - cve.2026.70465
logsource:
    product: windows
    service: dns-client
detection:
    selection:
        EventID: 3008
        QueryStatus: '0x1'
        QueryResults|contains:
            - '*.malicious.*'
            - '*.exploit.*'
    filter:
        QueryResults|endswith: '.local'
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate DNS responses with unusual names (rare)
    - DNS tunneling tools

YARA Rule

rule CVE_2026_70465_FortiClient_DNS_BufferOverflow
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects DNS response packets with abnormal length values targeting FortiClientWindows"
        cve = "CVE-2026-70465"
        date = "2026-01-15"
        score = 70
    strings:
        $dns_header = { ?? ?? 81 80 00 01 00 0? ?? ?? ?? ?? ?? ?? }
        $large_txt_record = { 00 10 FF FF 00 01 00 01 }
        $overflow_pattern = { FF FF 41 41 41 41 42 42 42 42 43 43 43 43 44 44 44 44 }
        $compression_ptr_loop = { C0 0C C0 0C C0 0C C0 0C }
    condition:
        uint16(0) == 0 and $dns_header and (
            $large_txt_record or
            $overflow_pattern or
            $compression_ptr_loop
        ) and filesize > 512
}

Suricata IDS Rule

alert udp any any -> any 53 (msg:"ET EXPLOIT CVE-2026-70465 FortiClientWindows DNS Response Buffer Overflow Attempt"; flow:to_client; content:"|81 80|"; depth:4; offset:2; content:"|C0 0C|"; distance:8; within:16; content:"|ff ff|"; distance:8; within:4; classtype:attempted-admin; sid:30070465; rev:1; reference:cve,CVE-2026-70465; reference:url,valtersit.com/CVE-2026-70465;)

Note: The rule targets DNS responses with the standard response flag (0x8180) that contain repeated compression pointers and oversized length fields consistent with buffer overflow payload delivery.

Elastic Detection

any where process.name == "FortiClientWindows.exe" and
  network.protocol == "dns" and network.direction == "ingress" and
  dns.answers.response_code == "NOERROR" and
  dns.answers.count > 15 and
  (dns.answers.records.data : "*AAAA*" or dns.answers.records.data : "*TXT*") and
  dns.answers.records.class == "IN"

Note: This EQL rule flags DNS response bursts with an unusually high answer count and large record types, which are consistent with buffer-overflow payload delivery.

Splunk SPL Query

index=windows source="WinEventLog:Microsoft-Windows-DNS-Client"
| WHERE EventCode=3008
| eval resp_length=len(QueryResults)
| WHERE resp_length > 500
| stats count by host, QueryResults, _time
| sort - count
| eval suspicious=if(match(QueryResults, "(?i)(exploit|shellcode|overflow|AAAA{20,})"), 1, 0)
| WHERE suspicious=1
| table _time, host, QueryResults, count

Note: The query detects DNS responses exceeding normal length thresholds (500+ characters) with suspicious content markers, indicating potential overflow payloads.

Wazuh OSSEC Rule

<group name="forticlient,cve-2026-70465,">
  <rule id="100465" level="12">
    <decoded>
      <program_name>FortiClient</program_name>
    </decoded>
    <field name="alert">.*buffer overflow.*|.*malformed DNS.*|.*unhandled exception.*</field>
    <description>FortiClientWindows potential CVE-2026-70465 buffer overflow triggered (malicious DNS response)</description>
    <group>cve-2026-70465,</group>
  </rule>
</group>

Note: This rule triggers on FortiClient log entries indicating buffer overflow errors or malformed DNS packet processing, which would occur on a temporary basis during exploitation.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. Fortinet has not released a fix for CVE-2026-70465 as of the writing of this report. The following steps are the only currently available mitigations:

1. Immediate Mitigations (compensating controls):

• Enforce DNS over HTTPS (DoH) or DNS over TLS (DoT) on all endpoints running FortiClientWindows, thereby removing the ability to forge DNS responses in transit.
• Enable DNSSEC validation on internal DNS infrastructure to reject spoofed responses.
• Segment network access so that endpoints process DNS only through trusted, monitored corporate resolvers.
• Use network access control (NAC) to prevent endpoints from associating with untrusted networks (e.g., rogue Wi-Fi) without a compliant VPN tunnel active.
• Apply host-based firewall rules to restrict outbound DNS to approved resolver IPs only.

2. Patch/Upgrade Steps:

• Monitor Fortinet's security advisory portal (https://www.fortiguard.com/psirt) daily for an advisory referencing CVE-2026-70465.
• Upon release of a patched version (expected to be 7.4.4+ or equivalent), deploy via FortiClient EMS or enterprise patch management system.
• Test the patch in a staging environment with representative network configurations before production rollout.
• Until the patch ships, consider downgrading to an unaffiliated version only if Fortinet confirms the vulnerability is not present in older branches (under receipt of vendor confirmation).

3. Long-Term Hardening:

• Restrict FortiClientWindows privileges by running the service under a least-privilege account where product limitations permit.
• Implement application allowlisting to prevent execution of unauthorized binaries that may be dropped post-exploitation.
• Deploy endpoint detection and response (EDR) solutions to provide memory-level visibility into overflow attempts.
• Harden DNS infrastructure organization-wide: deploy DNSSEC, encrypt DNS traffic, and monitor for aberrant DNS query/response patterns.
• Maintain rigorous patch management timelines for endpoint security products given their high-privilege execution context.
• Where possible, replace FortiClientWindows with an alternative vendor product or virtualize the agent in a sandboxed environment until Fortinet releases a permanent fix.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70465
2. Fortinet PSIRT Advisory Portal: https://www.fortiguard.com/psirt
3. CWE-120 Buffer Copy without Checking Size of Input: https://cwe.mitre.org/data/definitions/120.html
4. MITRE ATT&CK Technique — Impair Defenses: https://attack.mitre.org/techniques/T1562/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-70465 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns have been publicly attributed to CVE-2026-70465 at the time of writing. No exploit-in-the-wild evidence exists in open-source reporting. The vulnerability's potential for weaponization is high given the DHCP/DNS attack vector common in public network compromise chains, but no confirmed activity has been reported. Fortinet's PSIRT page should be consulted for updates on patch availability and advisory publication.