CVE-2026-48688

Vulnerability

In src/bgp_protocol.cpp, the function decode_mp_reach_ipv6() at line 156 contains a TODO comment explicitly acknowledging missing sanity checks. The function casts raw pointers to structure types without verifying sufficient data exists, uses attacker-controlled length_of_next_hop to determine memcpy size, and computes prefix_length from multiple attacker-controlled offsets without bounds validation [1][2][3]. Affected version: FastNetMon Community Edition through 1.2.9.

Exploitation

An attacker with a BGP peer session (e.g., through GoBGP) can send a crafted BGP UPDATE message with a malicious MP_REACH_NLRI attribute for the IPv6 address family. By controlling the length_of_next_hop field and other offsets, the attacker causes memcpy operations to read beyond the attribute's memory block without bounds checks [1].

Impact

Successful exploitation results in out-of-bounds reads from the attribute's memory block. This can lead to a denial of service (crash) or potential information disclosure of adjacent memory. The exact impact depends on the memory layout and the attacker's control over the size and offset fields [1].

Mitigation

As of the publication date (2026-05-26), FastNetMon LTD has not released a fix. The TODO comment remains unresolved in version 1.2.9 and earlier. No workaround is available other than restricting BGP peer sessions to trusted parties or disabling BGP functionality if not needed [1].