EUVD-2026-31897
GHSA-h9r4-jj3x-8857
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t)' using unsigned int (32-bit) arithmetic. With max_captured_packet_size=1500 and sizeof(fastnetmon_pcap_pkthdr_t)=16, each packet requires approximately 1516 bytes. If buffer_size_in_packets exceeds approximately 2,832,542, the multiplication overflows, resulting in a much smaller allocation than expected. Subsequent write_packet() calls then write past the allocated buffer, causing heap corruption. The buffer_size_in_packets value is derived from the ban_details_records_count configuration parameter, which is parsed using atoi() with no overflow checking.
AnalysisAI
Heap corruption in FastNetMon Community Edition through 1.2.9 allows authenticated local users to trigger an integer overflow in the packet capture buffer allocation routine, resulting in undersized allocations followed by out-of-bounds heap writes during packet storage. The flaw stems from 32-bit unsigned arithmetic in allocate_buffer() in src/packet_storage.hpp, where a sufficiently large ban_details_records_count configuration value causes the memory size calculation to wrap. No public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.01%.
Technical ContextAI
FastNetMon is an open-source DDoS detection and traffic analysis tool that captures packets into a pre-allocated ring-style buffer for forensic recording when bans are triggered. The vulnerable routine computes memory_size_in_bytes using unsigned 32-bit arithmetic as buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t); with the default 1500-byte capture size plus a 16-byte pcap packet header, each packet consumes ~1516 bytes, so a buffer_size_in_packets value above approximately 2,832,542 wraps the 32-bit product. The buffer_size_in_packets is derived from the ban_details_records_count configuration parameter parsed via atoi(), which performs no range or overflow validation. This maps to CWE-122 (Heap-based Buffer Overflow): the undersized allocation succeeds, then write_packet() iterates assuming the originally-requested size and writes past the heap chunk, corrupting adjacent heap metadata or objects.
RemediationAI
No vendor-released patch identified at time of analysis; the CVE references point to the upstream repository and the Lorikeet Security disclosure at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48690-packet-storage-integer-overflow rather than a tagged fix release, so operators should monitor https://github.com/pavel-odintsov/fastnetmon for a release above 1.2.9 and upgrade once published. As an interim compensating control, set ban_details_records_count in fastnetmon.conf to a conservative value well below 2,832,542 (e.g., the default or a few thousand records) - this directly prevents the multiplication from wrapping and has the trade-off of reducing the per-ban packet capture depth used for forensics. Additionally, restrict write access to fastnetmon.conf and the service's configuration management path to root/trusted operators only, since the overflow is reached through the configuration parser; this has minimal operational side effect in typical deployments where only administrators tune the tool.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today