Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by GitHub_M

CVE-2026-63418Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary

High 7.0

In plain English

A high-severity integer overflow in monitoring-plugins from monitoring-plugins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSmonitoring-pluginsno fix listedUBUNTU-CVE-2026-63418
Ubuntu:24.04:LTSmonitoring-pluginsno fix listedUBUNTU-CVE-2026-63418
Ubuntu:26.04:LTSmonitoring-pluginsno fix listedUBUNTU-CVE-2026-63418
Ubuntu:26.10monitoring-pluginsno fix listedUBUNTU-CVE-2026-63418

Affected products (as reported)

VendorProductVersions
monitoring-plugins monitoring-plugins >= 3.0.0-rc1, < 3.0.1

Weakness: CWE-190, CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References