Vulnerability · Published Jun 2, 2026 · Assigned by mitre
CVE-2026-48682
Medium 5.9
In plain English
A medium-severity out-of-bounds read in the fastnetmon package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48682 |
| Debian:13 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48682 |
| Debian:14 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48682 |
| Ubuntu:25.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48682 |
| Ubuntu:26.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48682 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N