QSearchQSearch

CVE-2026-48685

6.5 MEDIUM

FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the ext...

Published: 2026-05-26 · Last updated: 2026-05-27

Severity and scoring

CVSS
6.5 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-130

Affected products

VendorProduct
pavel-odintsovfastnetmon

Description

FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set. In src/bgp_protocol.hpp, the parse_raw_bgp_attribute() function correctly identifies when extended_length_bit is set and sets length_of_length_field to 2, but then reads only a single byte for the attribute value length (attribute_value_length = value[2] at line 173). Per RFC 4271 Section 4.3, when the Extended Length bit is set, the Attribute Length field is two octets and the value should be read as a 16-bit big-endian integer from value[2] and value[3]. As a result, any attribute longer than 255 bytes has its length silently truncated to the low byte (e.g., 300 bytes = 0x012C is read as 0x2C = 44 bytes). The remaining 256 bytes are then misinterpreted as subsequent attributes, causing cascading parse failures and potential out-of-bounds memory access.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-48689 — FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dy... (9.8 CRITICAL)
  • CVE-2026-48696 — FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689 (6.2 MEDIUM)
  • CVE-2026-48695 — FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin (8.1 HIGH)
  • CVE-2026-48694 — FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin (8.1 HIGH)
  • CVE-2026-48697 — FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections (7.4 HIGH)

Same CWE

  • CVE-2026-45681 — OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard (5.9 MEDIUM)
  • CVE-2026-45615 — mouse07410/asn1c is an ASN.1 compiler (8.2 HIGH)
  • CVE-2026-33846 — A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS (7.5 HIGH)
  • CVE-2026-31635 — In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verif... (7.5 HIGH)
  • CVE-2026-5367 — A flaw was found in OVN (Open Virtual Network) (8.6 HIGH)