CVE-2026-48690
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In FastNetMon Community Edition up to 1.2.9, an integer overflow in the packet capture buffer allocation function allocate_buffer() leads to a smaller-than-expected buffer and subsequent heap corruption via out-of-bounds writes.
Risk Assessment
An attacker can cause heap corruption, potentially leading to arbitrary code execution or denial of service.
Recommendation
Update FastNetMon Community Edition to version 1.2.10 or later if available.
Other vulnerabilities in FastNetMon Community Edition
See all- CVE-2026-48697High
FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function fails to call set_verify_mode(verify_peer), so OpenSSL does not validate the server's certificate chain. This function is used for telemetry reporting, sending system information.
- CVE-2026-48683Medium
FastNetMon Community Edition through 1.2.9 has an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. The Data template branch iterates without bounds checking, while the Options template branch does. Since templates are sent via unauthenticated UDP, an attacker can craft templates to read memory past the packet buffer.
Original NVD description (English source)
FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t)' using unsigned int (32-bit) arithmetic. With max_captured_packet_size=1500 and sizeof(fastnetmon_pcap_pkthdr_t)=16, each packet requires approximately 1516 bytes. If buffer_size_in_packets exceeds approximately 2,832,542, the multiplication overflows, resulting in a much smaller allocation than expected. Subsequent write_packet() calls then write past the allocated buffer, causing heap corruption. The buffer_size_in_packets value is derived from the ban_details_records_count configuration parameter, which is parsed using atoi() with no overflow checking.