What is the CVSS score of CVE-2026-48686?

CVE-2026-48686 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FastNetMon Community are affected by CVE-2026-48686?

FastNetMon Community Edition through 1.2.9 is vulnerable to critical remote code execution through malformed BGP network messages, allowing unauthenticated attackers to gain complete control of…

How to fix or mitigate CVE-2026-48686?

Within 24 hours: Isolate all FastNetMon Community Edition systems running version 1.2.9 or earlier from internet-facing networks and restrict BGP (TCP/UDP 179) traffic to only documented, trusted BGP peers via firewall rules. Within 7 days: Evaluate alternative BGP monitoring solutions with current security support and deploy network-based BGP anomaly detection for malformed message identification. Within 30 days: Complete migration away from FastNetMon Community Edition to an actively maintained alternative and validate full monitoring functionality.

FastNetMon Community CVE-2026-48686

EUVD-2026-31842 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-05-26 mitre

GHSA-7p7c-c3vp-p386

Buffer Overflow RCE N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:33 vuln.today

CVSS changed

May 26, 2026 - 21:22 NVD

9.8 (CRITICAL)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the BGP packet (line 99) without validating it is <= 32 for IPv4 prefixes. This value is passed to how_much_bytes_we_need_for_storing_certain_subnet_mask() which computes ceil(prefix_bit_length / 8), returning up to 32 bytes for a prefix_bit_length of 255. The result is used as the length argument to memcpy() (line 106), which copies into a 4-byte uint32_t stack variable (prefix_ipv4). This causes a stack buffer overflow of up to 28 bytes, which can be exploited for arbitrary code execution. Additionally, the unvalidated prefix_bit_length is passed to convert_cidr_to_binary_netmask_local_function_copy() (line 111), where a shift of (32 - cidr) with cidr > 32 causes undefined behavior.

AnalysisAI

Stack-based buffer overflow in FastNetMon Community Edition through 1.2.9 allows remote unauthenticated attackers to achieve arbitrary code execution by sending a crafted BGP UPDATE message containing a malformed NLRI prefix length value. The vulnerable function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the wire without bounding it to the IPv4 maximum of 32, enabling a memcpy of up to 32 bytes into a 4-byte stack variable - a potential 28-byte stack smash. Despite a critical CVSS score of 9.8 and SSVC technical impact rated 'total', EPSS sits at just 0.02% (7th percentile) and SSVC exploitation status is 'none', indicating no known active exploitation at time of analysis; however, a public security research writeup from Lorikeetsecurity exists that details the flaw.

Technical ContextAI

FastNetMon Community Edition is an open-source DDoS detection tool that processes live BGP session data. The vulnerable code path is in src/bgp_protocol.cpp, where the function decode_bgp_subnet_encoding_ipv4_raw() handles BGP NLRI (Network Layer Reachability Information) encoding for IPv4 prefixes as part of BGP UPDATE message parsing. CWE-120 (Buffer Copy without Checking Size of Input - 'Classic Buffer Overflow') is the root cause class: prefix_bit_length is read directly from the attacker-controlled BGP packet at line 99 with no validation that the value is bounded by 32 (the maximum valid IPv4 prefix length). The helper function how_much_bytes_we_need_for_storing_certain_subnet_mask() computes ceil(prefix_bit_length / 8), which returns up to 32 bytes when prefix_bit_length is 255. That computed length is passed directly to memcpy() at line 106, copying into a 4-byte uint32_t stack variable (prefix_ipv4), producing a stack overflow of up to 28 bytes. A secondary undefined-behavior flaw exists at line 111 in convert_cidr_to_binary_netmask_local_function_copy(), where a bitwise left shift of (32 - cidr) with cidr > 32 produces undefined behavior per the C standard. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-informative; affected product identity is confirmed from the description and GitHub repository reference.

RemediationAI

No vendor-released patched version has been identified in the available data at time of analysis. Operators should monitor the FastNetMon GitHub repository at https://github.com/pavel-odintsov/fastnetmon for a patched release and apply it immediately upon availability. As a compensating control, restrict BGP session peering to explicitly trusted IP addresses using firewall ACLs or BGP peer authentication (TCP MD5 or BGP OPEN message authentication), which reduces the exploitable attack surface to only established, trusted BGP peers - note this does not eliminate risk if a trusted peer is compromised. Disabling or isolating the BGP listener component entirely is the most effective workaround if BGP feed functionality is not operationally required, though this will disable BGP-based traffic visibility. Network segmentation placing FastNetMon listeners behind a BGP-aware firewall or route reflector that drops malformed NLRI attributes can provide additional defense. Review the Lorikeetsecurity security advisory at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48686-bgp-nlri-stack-overflow for any researcher-identified mitigations.