Vulnerability · Published May 26, 2026 · Assigned by mitre
CVE-2026-48685
Medium 6.5
In plain English
A medium-severity security flaw in the fastnetmon package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set. In src/bgp_protocol.hpp, the parse_raw_bgp_attribute() function correctly identifies when extended_length_bit is set and sets length_of_length_field to 2, but then reads only a single byte for the attribute value length (attribute_value_length = value[2] at line 173). Per RFC 4271 Section 4.3, when the Extended Length bit is set, the Attribute Length field is two octets and the value should be read as a 16-bit big-endian integer from value[2] and value[3]. As a result, any attribute longer than 255 bytes has its length silently truncated to the low byte (e.g., 300 bytes = 0x012C is read as 0x2C = 44 bytes). The remaining 256 bytes are then misinterpreted as subsequent attributes, causing cascading parse failures and potential out-of-bounds memory access.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48685 |
| Debian:13 | fastnetmon | 1.2.9-0+deb13u1 | DEBIAN-CVE-2026-48685 |
| Debian:14 | fastnetmon | 1.2.9-1 | DEBIAN-CVE-2026-48685 |
| Ubuntu:25.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48685 |
| Ubuntu:26.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48685 |
Affected products (as reported)
Weakness: CWE-130 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H