A heap-based buffer overflow vulnerability (CWE-122) exists in Fortinet FortiClient for Windows versions 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8. This flaw may allow an authenticated local IPSec user to execute arbitrary code or commands via the "fortips_74.sys" component. Exploitation requires bypassing Windows heap integrity protections.