FastNetMon Community Edition up to 1.2.9 dynamic_binary_buffer.hpp off-by-one

Summaryinfo

A vulnerability described as problematic has been identified in FastNetMon Community Edition up to 1.2.9. Affected by this issue is the function append_dynamic_buffer/append_data_as_pointer/append_data_as_object_ptr/memcpy_from_ptr/memcpy_from_object_ptr of the file src/dynamic_binary_buffer.hpp. Such manipulation leads to off-by-one. This vulnerability is uniquely identified as CVE-2026-48689. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in FastNetMon Community Edition up to 1.2.9. Affected by this issue is the function append_dynamic_buffer/append_data_as_pointer/append_data_as_object_ptr/memcpy_from_ptr/memcpy_from_object_ptr of the file src/dynamic_binary_buffer.hpp. The manipulation with an unknown input leads to a off-by-one vulnerability. Using CWE to declare the problem leads to CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. Impacted is confidentiality, integrity, and availability. CVE summarizes:

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-48689 since 05/22/2026. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/19/2026).

The vulnerability scanner Nessus provides a plugin with the ID 321184 (Ubuntu 20.04 LTS / 24.04 LTS / 26.04 LTS : FastNetMon vulnerabilities (USN-8429-1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (321184) and EUVD (EUVD-2026-31956). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• FastNetMon

Name

• Community Edition

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion