Vulnerability · Published May 26, 2026 · Assigned by mitre
CVE-2026-48689
Critical 9.8
In plain English
A critical-severity heap buffer overflow in the fastnetmon package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | fastnetmon | 1.2.9-0+deb13u1 | DEBIAN-CVE-2026-48689 |
| Debian:14 | fastnetmon | 1.2.9-1 | DEBIAN-CVE-2026-48689 |
| Ubuntu:25.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48689 |
| Ubuntu:26.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48689 |
Affected products (as reported)
Weakness: CWE-193, CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H