CVE-2026-48689

Vulnerability

FastNetMon Community Edition through version 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class defined in src/dynamic_binary_buffer.hpp [1][3]. Five methods—append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, and memcpy_from_object_ptr—use an incorrect bounds check of the form if (offset + length > maximum_internal_storage_size + 1) instead of the correct if (offset + length > maximum_internal_storage_size) [1]. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction [1]. Version 1.2.9 is the latest affected release; the bug was confirmed in the official source repository [3].

Exploitation

An attacker can exploit this vulnerability remotely by sending crafted network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance [1]. No authentication is required. By carefully constructing sequences of NetFlow templates or other protocol data, the attacker triggers the off-by-one overflow in one of the five vulnerable methods [1]. The overflow places a single byte beyond the buffer boundary, which can corrupt adjacent heap metadata (e.g., chunk size fields) [1]. This is a well-documented technique, similar to the “House of Einherjar” family of heap exploits [1].

Impact

Successful exploitation allows an attacker to corrupt heap metadata, potentially leading to arbitrary code execution in the context of the FastNetMon process [1]. The CVSS v3 base score is 9.8 (Critical), indicating remote, unauthenticated access with high impact on confidentiality, integrity, and availability [1]. The FastNetMon build lacks compiler hardening, which shortens the exploitation path from sending a particular sequence of NetFlow templates to achieving code execution as the FastNetMon process user [1].

Mitigation

As of the published date (2026-05-26), no patched version of FastNetMon Community Edition is available [1][2]. The recommended mitigation is to upgrade to a fixed version once released [1]. If immediate patching is not possible, administrators should restrict network access to FastNetMon instances using firewalls or network segmentation to limit exposure to untrusted traffic [1]. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.