The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Forticlient | Fortinet | * | 5.2.3 (including) |