CVE-2026-48682

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pavel-odintsov/fastnetmon
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/simple_packet_parser_ng.cpp
https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48682-ipv4-parser-oob

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-02 20:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-48682

Mitre link : CVE-2026-48682

CVE.ORG link : CVE-2026-48682

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-48682", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48682", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T16:04:36.835083Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-02T20:16:38.993", "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon", "source": "cve@mitre.org"}, {"url": "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/simple_packet_parser_ng.cpp", "source": "cve@mitre.org"}, {"url": "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48682-ipv4-parser-oob", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface."}, {"lang": "es", "value": "FastNetMon Community Edition hasta la versi\u00f3n 1.2.9 contiene una lectura fuera de l\u00edmites en el analizador de paquetes IPv4. En src/simple_packet_parser_ng.cpp, despu\u00e9s de validar que el paquete contiene al menos sizeof(ipv4_header_t) bytes (20 bytes), el c\u00f3digo avanza el local_pointer en '4 * ipv4_header->get_ihl()' (l\u00ednea 164) sin validar que (a) IHL >= 5 (el valor m\u00ednimo v\u00e1lido seg\u00fan RFC 791), o (b) 4 * IHL bytes est\u00e9n realmente disponibles en el paquete. El campo IHL es de 4 bits, permitiendo valores de 0 a 15, por lo que el avance puede ser de 0 a 60 bytes. Un valor IHL de 15 con solo 20 bytes validados causa una lectura excesiva de 40 bytes. Un IHL de 0-4 hace que el puntero no avance m\u00e1s all\u00e1 de la cabecera IP, lo que resulta en que la cabecera TCP/UDP se analice a partir de datos de la cabecera IP (confusi\u00f3n de tipos). Esta vulnerabilidad es alcanzable a trav\u00e9s de cualquier interfaz de captura de paquetes."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "cve@mitre.org"}