What is the CVSS score of CVE-2026-48690?

CVE-2026-48690 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of FastNetMon Community Edition are affected by CVE-2026-48690?

FastNetMon Community Edition through version 1.2.9 contains a heap corruption vulnerability that allows authenticated local users to trigger memory corruption and potential code execution through…

How to fix or mitigate CVE-2026-48690?

Within 24 hours: Inventory all FastNetMon deployments and document versions; immediately restrict local system access to FastNetMon hosts to authorized administrative accounts only, enforcing principle of least privilege. Within 7 days: Monitor FastNetMon vendor advisories and GitHub repository for patch release; review and harden local access controls via SSH key management and sudo restrictions. Within 30 days: Apply vendor patch immediately upon release, or evaluate migration to alternative network monitoring solutions (e.g., Suricata, Zeek) if patch timeline is undefined.

FastNetMon Community Edition CVE-2026-48690

EUVD-2026-31897 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-26 mitre

GHSA-h9r4-jj3x-8857

Heap Overflow Buffer Overflow N A

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:05 vuln.today

CVSS changed

May 26, 2026 - 21:22 NVD

7.1 (HIGH)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t)' using unsigned int (32-bit) arithmetic. With max_captured_packet_size=1500 and sizeof(fastnetmon_pcap_pkthdr_t)=16, each packet requires approximately 1516 bytes. If buffer_size_in_packets exceeds approximately 2,832,542, the multiplication overflows, resulting in a much smaller allocation than expected. Subsequent write_packet() calls then write past the allocated buffer, causing heap corruption. The buffer_size_in_packets value is derived from the ban_details_records_count configuration parameter, which is parsed using atoi() with no overflow checking.

AnalysisAI

Heap corruption in FastNetMon Community Edition through 1.2.9 allows authenticated local users to trigger an integer overflow in the packet capture buffer allocation routine, resulting in undersized allocations followed by out-of-bounds heap writes during packet storage. The flaw stems from 32-bit unsigned arithmetic in allocate_buffer() in src/packet_storage.hpp, where a sufficiently large ban_details_records_count configuration value causes the memory size calculation to wrap. No public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.01%.

Technical ContextAI

FastNetMon is an open-source DDoS detection and traffic analysis tool that captures packets into a pre-allocated ring-style buffer for forensic recording when bans are triggered. The vulnerable routine computes memory_size_in_bytes using unsigned 32-bit arithmetic as buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t); with the default 1500-byte capture size plus a 16-byte pcap packet header, each packet consumes ~1516 bytes, so a buffer_size_in_packets value above approximately 2,832,542 wraps the 32-bit product. The buffer_size_in_packets is derived from the ban_details_records_count configuration parameter parsed via atoi(), which performs no range or overflow validation. This maps to CWE-122 (Heap-based Buffer Overflow): the undersized allocation succeeds, then write_packet() iterates assuming the originally-requested size and writes past the heap chunk, corrupting adjacent heap metadata or objects.

RemediationAI

No vendor-released patch identified at time of analysis; the CVE references point to the upstream repository and the Lorikeet Security disclosure at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48690-packet-storage-integer-overflow rather than a tagged fix release, so operators should monitor https://github.com/pavel-odintsov/fastnetmon for a release above 1.2.9 and upgrade once published. As an interim compensating control, set ban_details_records_count in fastnetmon.conf to a conservative value well below 2,832,542 (e.g., the default or a few thousand records) - this directly prevents the multiplication from wrapping and has the trade-off of reducing the per-ban packet capture depth used for forensics. Additionally, restrict write access to fastnetmon.conf and the service's configuration management path to root/trusted operators only, since the overflow is reached through the configuration parser; this has minimal operational side effect in typical deployments where only administrators tune the tool.