What is the CVSS score of CVE-2026-48689?

CVE-2026-48689 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FastNetMon are affected by CVE-2026-48689?

FastNetMon Community Edition through version 1.2.9 contains a critical remote code execution vulnerability (CVSS 9.8) reachable by unauthenticated network attackers through standard DDoS telemetry…

How to fix or mitigate CVE-2026-48689?

No public exploit identified at time of analysis, but vulnerability severity and absence of patch warrant immediate action. Within 24 hours: Identify all FastNetMon Community Edition instances running version 1.2.9 or earlier; assess network exposure to external telemetry sources. Within 7 days: Restrict NetFlow, sFlow, IPFIX, and BGP traffic to authorized monitoring sources via firewall rules; implement network segmentation to minimize exposure. Within 30 days: Execute migration plan to patched versions when released or transition to alternative DDoS detection platform; establish continuous monitoring of vendor advisory channels.

FastNetMon CVE-2026-48689

EUVD-2026-31956 CRITICAL

Out-of-bounds Write (CWE-787)

2026-05-26 mitre

GHSA-5444-f65m-f3c8

RCE Buffer Overflow Memory Corruption N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 26, 2026 - 21:28 vuln.today

CVSS changed

May 26, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.

AnalysisAI

Remote code execution in FastNetMon Community Edition through 1.2.9 stems from an off-by-one heap write in the pervasively-used dynamic_binary_buffer_t class, reachable by anyone who can send NetFlow, sFlow, IPFIX, or BGP traffic to the DDoS-detection appliance. Because the flawed buffer is exercised during BGP encoding/decoding, NetFlow template parsing, and Flow Spec NLRI construction, an unauthenticated network attacker can corrupt adjacent heap metadata and potentially execute arbitrary code. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

FastNetMon is an open-source/commercial DDoS detection and mitigation tool that ingests high-volume flow telemetry (NetFlow v5/v9, IPFIX, sFlow) and speaks BGP/Flow Spec to trigger blackholing or filtering. The defect is a classic CWE-787 out-of-bounds write: in src/dynamic_binary_buffer.hpp, five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) guard copies with 'if (offset + length > maximum_internal_storage_size + 1)' rather than the correct '> maximum_internal_storage_size', permitting exactly one byte to be written past the end of the heap allocation. The append_byte() method uses the correct check, which both confirms the bug is an inconsistency rather than intended slack and narrows the root cause. Because dynamic_binary_buffer_t backs the binary serialization paths for multiple wire protocols, the off-by-one is triggerable from several distinct, attacker-influenced parsing/encoding routines. The CPE string supplied (cpe:2.3:a:n/a:n/a:*) is a malformed placeholder and does not identify the product, so exact affected-package identification relies on the description.

RemediationAI

No vendor-released patch version is identified at time of analysis - the references point to the upstream repository and the affected header file rather than to a tagged fixed release, so monitor the FastNetMon project (https://github.com/pavel-odintsov/fastnetmon) for a release above 1.2.9 that corrects the five bounds checks from '> maximum_internal_storage_size + 1' to '> maximum_internal_storage_size', and apply it as the primary fix. Until a patched build is available, reduce exposure with network-layer controls: restrict the NetFlow/sFlow/IPFIX collector ports and the BGP listener (TCP/179) with firewall ACLs so only known, trusted exporters and BGP peers can reach the instance - accepting that this breaks telemetry or peering from any source you forget to allowlist; place the FastNetMon management/collector interface on an isolated network segment unreachable from untrusted hosts; and consider temporarily disabling BGP/Flow Spec announcement features if they are not in active use, with the trade-off that automated mitigation actions will stop. Organizations building from source may also apply the one-line correction to dynamic_binary_buffer.hpp directly. Consult the third-party technical write-up at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48689-dynamic-buffer-off-by-one and the VulDB advisory at https://vuldb.com/vuln/365762 for further detail.