CVE-2026-48682 Details
Description
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
A vulnerability allowing out-of-bounds read has been identified in FastNetMon Community Edition versions through 1.2.9. The issue arises in the IPv4 packet parser, where the Internet Header Length (IHL) field is not properly validated before the parser advances the reading pointer. This oversight can lead to reading 40 bytes beyond the end of the validated packet, potentially causing information disclosure from adjacent process memory and type confusion in downstream protocol parsers. The vulnerability is accessible through any packet capture interface.
Users are advised to update FastNetMon to a version later than 1.2.9 that includes the IHL validation fix. Until the patch is applied, FastNetMon can be run as a low-privilege user and should be configured to restrict NetFlow, sFlow, and IPFIX collectors to known router IPs only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pavel-odintsov/fastnetmon | [email protected] | Vendor |
| https://github.com/pavel-odintsov/fastnetmon/blob/master/src/simple_packet_parser_ng.cpp | [email protected] | Source CodeVendor |
| https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48682-ipv4-parser-oob | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| FastNetMon | <= 1.2.9 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |