FastNetMon Community Edition up to 1.2.9/4.3 src/bgp_protocol.hpp parse_raw_bgp_attribute out-of-bounds

Summaryinfo

A vulnerability described as problematic has been identified in FastNetMon Community Edition up to 1.2.9/4.3. This affects the function parse_raw_bgp_attribute of the file src/bgp_protocol.hpp. The manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2026-48685. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in FastNetMon Community Edition up to 1.2.9/4.3. Affected is the function parse_raw_bgp_attribute of the file src/bgp_protocol.hpp. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality. CVE summarizes:

FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set. In src/bgp_protocol.hpp, the parse_raw_bgp_attribute() function correctly identifies when extended_length_bit is set and sets length_of_length_field to 2, but then reads only a single byte for the attribute value length (attribute_value_length = value[2] at line 173). Per RFC 4271 Section 4.3, when the Extended Length bit is set, the Attribute Length field is two octets and the value should be read as a 16-bit big-endian integer from value[2] and value[3]. As a result, any attribute longer than 255 bytes has its length silently truncated to the low byte (e.g., 300 bytes = 0x012C is read as 0x2C = 44 bytes). The remaining 256 bytes are then misinterpreted as subsequent attributes, causing cascading parse failures and potential out-of-bounds memory access.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-48685 since 05/22/2026. The exploitability is told to be easy. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31841). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• FastNetMon

Name

• Community Edition

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 4.0
• 4.1
• 4.2
• 4.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion