Monitoring Plugins up to 3.0.0 check_icmp process_arguments Host memory corruption

Summaryinfo

A vulnerability, which was classified as very critical, was found in Monitoring Plugins up to 3.0.0. This impacts the function process_arguments of the component check_icmp. Executing a manipulation of the argument Host can lead to memory corruption. This vulnerability is handled as CVE-2026-63418. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in Monitoring Plugins up to 3.0.0. This vulnerability affects the function process_arguments of the component check_icmp. The manipulation of the argument Host with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-63418 since 07/16/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/03/2026).

Upgrading to version 3.0.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Monitoring Plugins

Version

• 3.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion