What is the CVSS score of CVE-2026-48688?

CVE-2026-48688 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of FastNetMon Community Edition are affected by CVE-2026-48688?

FastNetMon Community Edition (versions ≤1.2.9) contains a remote memory-leakage vulnerability allowing unauthenticated attackers to extract sensitive network and process data via malformed BGP…

How to fix or mitigate CVE-2026-48688?

Within 24 hours: Inventory all FastNetMon Community Edition deployments at version 1.2.9 or earlier; isolate instances handling untrusted BGP input to dedicated network segments. Within 7 days: Deploy network access controls restricting BGP UPDATE message senders to pre-approved peer ASNs; implement packet filtering to reject malformed IPv6 MP_REACH_NLRI attributes on BGP edges; enable logging of all BGP session state changes. Within 30 days: Evaluate migration to patched FastNetMon version (monitor upstream releases) or alternative network monitoring solutions; document rollback plan if production dependency is high.

FastNetMon Community Edition CVE-2026-48688

EUVD-2026-31844 HIGH

Out-of-bounds Read (CWE-125)

2026-05-26 mitre

GHSA-rxgw-72v4-4rvj

Information Disclosure Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:55 vuln.today

CVSS changed

May 26, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The function decode_mp_reach_ipv6() in src/bgp_protocol.cpp contains a TODO comment at line 156 explicitly acknowledging 'we should add sanity checks to avoid reads after attribute memory block.' The function casts raw pointers to structure types without verifying sufficient data exists (line 158), uses the attacker-controlled length_of_next_hop field to determine memcpy size (line 181), and computes prefix_length by dereferencing a pointer calculated from multiple attacker-controlled offsets without bounds validation (line 189). The prefix_length is then used to calculate number_of_bytes_required_for_prefix which becomes a memcpy length (line 202) with no check against remaining buffer size.

AnalysisAI

Out-of-bounds read in FastNetMon Community Edition through 1.2.9 allows remote unauthenticated attackers to leak adjacent process memory by sending crafted BGP UPDATE messages containing malformed MP_REACH_NLRI IPv6 attributes. The flaw resides in decode_mp_reach_ipv6() where attacker-controlled length fields drive memcpy operations without bounds validation, and is acknowledged by an in-source TODO comment by the maintainer. No public exploit identified at time of analysis, EPSS is low (0.03%), and CISA SSVC classifies exploitation as 'none' but 'automatable: yes', meaning weaponization is technically straightforward if a threat actor invests effort.

Technical ContextAI

FastNetMon is an open-source DDoS detection and traffic analysis tool that establishes BGP sessions with routers to receive routing updates and signal blackholing/flowspec mitigations. The vulnerable code path is decode_mp_reach_ipv6() in src/bgp_protocol.cpp, which parses BGP multiprotocol extension attribute MP_REACH_NLRI (RFC 4760) for IPv6 address families. The function exhibits classic CWE-125 (Out-of-bounds Read) patterns: raw pointer casts to BGP attribute structures without length verification (line 158), use of attacker-supplied length_of_next_hop as a memcpy size (line 181), and prefix_length dereferenced from a pointer derived from multiple untrusted offsets (line 189) then fed into another unchecked memcpy (line 202). The maintainer's own TODO at line 156 explicitly documents the missing sanity checks, indicating known but unmitigated technical debt.

RemediationAI

No vendor-released patch identified at time of analysis - the referenced source file still contains the TODO acknowledging missing sanity checks, so operators should monitor https://github.com/pavel-odintsov/fastnetmon for a release beyond 1.2.9 and upgrade once an upstream fix lands. As compensating controls, restrict the FastNetMon BGP listener to trusted router peers using host firewall rules (iptables/nftables) or a dedicated management VRF so that only authenticated peer IPs can reach the BGP port (typically TCP/179), which eliminates exposure from arbitrary network attackers at the cost of requiring per-peer firewall maintenance; enable BGP TCP-MD5 or TCP-AO authentication on sessions if both ends support it, noting it does not prevent a malicious peer from sending crafted attributes; and consider disabling MP-BGP IPv6 address-family negotiation on FastNetMon's BGP configuration if IPv6 BGP feeds are not operationally required, which trades IPv6 visibility for elimination of the vulnerable code path. Consult the technical write-up at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48688-bgp-mp-reach-nlri-ipv6 for additional context before applying mitigations.