CVE-2026-48683

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow_v9_collector.cpp, the Data template branch (lines 1695-1702) iterates over flow records without performing a per-iteration bounds check against the packet end pointer. In contrast, the Options template branch (lines 1709-1719) correctly checks 'if (pkt + offset + field_template->total_length > packet_end)' before each iteration. The Data branch omits this check entirely. Since template definitions are sent by the network peer (and are unauthenticated UDP), an attacker can craft templates that cause the parser to read arbitrary memory past the packet buffer. This can leak sensitive memory contents or cause a crash.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pavel-odintsov/fastnetmon
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netflow_v9_collector.cpp
https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48683-netflow-v9-data-oob

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-26 16:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-48683

Mitre link : CVE-2026-48683

CVE.ORG link : CVE-2026-48683

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-48683", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48683", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T20:14:09.229501Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T16:16:26.330", "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon", "source": "cve@mitre.org"}, {"url": "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netflow_v9_collector.cpp", "source": "cve@mitre.org"}, {"url": "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48683-netflow-v9-data-oob", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow_v9_collector.cpp, the Data template branch (lines 1695-1702) iterates over flow records without performing a per-iteration bounds check against the packet end pointer. In contrast, the Options template branch (lines 1709-1719) correctly checks 'if (pkt + offset + field_template->total_length > packet_end)' before each iteration. The Data branch omits this check entirely. Since template definitions are sent by the network peer (and are unauthenticated UDP), an attacker can craft templates that cause the parser to read arbitrary memory past the packet buffer. This can leak sensitive memory contents or cause a crash."}, {"lang": "es", "value": "FastNetMon Community Edition hasta la versi\u00f3n 1.2.9 contiene una vulnerabilidad de lectura fuera de l\u00edmites en el procesador de conjuntos de flujo de datos NetFlow v9. En src/netflow_plugin/netflow_v9_collector.cpp, la rama de plantilla de datos (l\u00edneas 1695-1702) itera sobre registros de flujo sin realizar una verificaci\u00f3n de l\u00edmites por iteraci\u00f3n contra el puntero de fin de paquete. En contraste, la rama de plantilla de opciones (l\u00edneas 1709-1719) verifica correctamente 'if (pkt + offset + field_template - total_length > packet_end)' antes de cada iteraci\u00f3n. La rama de datos omite esta verificaci\u00f3n por completo. Dado que las definiciones de plantilla son enviadas por el par de red (y son UDP no autenticado), un atacante puede crear plantillas que hacen que el analizador lea memoria arbitraria m\u00e1s all\u00e1 del b\u00fafer de paquetes. Esto puede filtrar contenido de memoria sensible o causar un fallo."}], "lastModified": "2026-07-24T11:10:00.170", "sourceIdentifier": "cve@mitre.org"}