Out-of-bounds access in CAPWAP daemon

unknownCVE-2025-53844

CVSSv3 Score: 8.3 An Out-Of-Bounds Write vulnerability [CWE-787] in FortiOS capwap daemon may allow an attacker controlling an authenticated FortiAP FortiExtender or FortiSwitch to gain execution privileges on the FortiGate device Revised on 2026-05-12 00:00:00

CSIRTS triage

vendor: Fortinet product: FortiOS Memory corruption

What: An out-of-bounds write vulnerability may allow attackers to gain execution privileges.
Who is affected: Authenticated users controlling FortiAP, FortiExtender, or FortiSwitch.
Urgency: Remediation is urgent due to the high severity and potential for privilege escalation.
Action: Apply patches as soon as they are available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiOS

Get an email when a new FortiOS advisory drops — max one per day, one-click unsubscribe.

Details

Source: Fortinet FortiGuard PSIRT (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-05-12
Exploitation: Not in CISA KEV at last sync

Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-123

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-538440.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-53844	coverage & exploitation status	NVD · CVE.org

Recent advisories for Out-of-bounds access in

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-57251: The application opens a PDF, but the cloud-like appearance of the construction process lacks p…nvd · 2026-07-08
mediumCVE-2026-14612: Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can…nvd · 2026-07-03
mediumCVE-2026-43676: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed…nvd · 2026-06-29
mediumCVE-2026-28979: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed…nvd · 2026-06-29
highCVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode()msrc · 2026-06-09
criticalCVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()msrc · 2026-06-09