EUVD-2026-116114Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged shell
-
DeliveryLocate setuid-root check_icmp binary
-
ExploitInvoke with >65,535 -H/Host entries
-
ExecutionWrap unsigned-short counter, undersize heap array
-
PersistWrite host entries out of bounds as root
-
ImpactPotential heap corruption / privilege escalation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local low-privileged shell access on a host where check_icmp is installed setuid-root (confirmed for the Arch Linux monitoring-plugins package). The attacker must invoke check_icmp supplying more than 65,535 hosts, either as repeated -H/--Host arguments or via an --extra-opts ini file containing many Host= entries, to wrap the unsigned-short counter. Exploitation is strictly limited to the setuid-root deployment mode: installations that grant raw-socket access via the cap_net_raw file capability instead of the setuid bit are NOT exposed to the privilege-escalation consequence. Further limiting factors: no remote vector (local only), and reliable privilege escalation from the heap corruption has not been demonstrated. |
| Impact | This is a moderate, locally-scoped privilege-escalation risk rather than an urgent remote threat. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) correctly frames it as a local-only issue: an attacker already needs a low-privileged shell on the host (PR:L), the vector is local (AV:L), and complexity is high (AC:H), consistent with the advisory's own statement that reliable privilege escalation has NOT been demonstrated. The high C/I/A impacts reflect the best-case outcome (root compromise via heap corruption in a setuid-root process), not a proven capability. No EPSS score was provided in the input and the CVE is not in CISA KEV, so there is no signal of active or widespread exploitation; EPSS absence should not be treated as 'low risk', merely as missing data. No public exploit code reference is present - only the advisory, fix commit, and release are linked - so this is a memory-corruption primitive with plausible but unproven escalation. The vuln.today decision label is 'this_week', which aligns with a real-but-not-emergency priority: patch on a normal cycle. A key scoping nuance: exposure is conditional on the setuid-root install mode (confirmed on Arch Linux); deployments using cap_net_raw file capabilities are not exposed to the privilege-escalation consequence at all, which should significantly narrow the affected population. |
| Exploit ScenarioDerived | A local, low-privileged user on a host where check_icmp is installed setuid-root invokes the binary with more than 65,535 host arguments (via repeated -H/--Host flags or an --extra-opts ini file containing many Host= entries). The unsigned-short host counter wraps, process_arguments() allocates an undersized heap array, and subsequent host entries are written out of bounds while the process is still running as root, before setuid(getuid()) drops privileges. No public exploit code is available, and reliable conversion of this heap corruption into code execution has not been demonstrated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap memory corruption in the check_icmp plugin shipped with Monitoring Plugins 3.0.0-rc1 through 3.0.0 gives a local low-privileged user an out-of-bounds write inside a process that still holds root privileges when check_icmp is installed setuid-root. Passing more than 65,535 hosts, either as repeated -H/--Host arguments or as Host= entries in an --extra-opts ini file, wraps an unsigned short host counter so process_arguments() allocates an undersized hosts array and writes later entries past its end, all before main() performs setuid(getuid()). This is a moderate, locally-scoped privilege-escalation risk rather than an urgent remote threat: there is no remote vector, reliable privilege escalation from the corruption has not been demonstrated, and no public exploit code was identified in the available sources; the fix is enforcing an explicit host-count bound.
RemediationAI
Upgrade to Monitoring Plugins 3.0.1 or later, which enforces an explicit bound on the host count in both the -H/--Host argv path and the --extra-opts path; the fix is contained in commit c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a and the v3.0.1 release, with details in the advisory at https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q. Where upgrading is not immediately possible, convert setuid-root installations to the capability-based deployment the advisory describes as unaffected: remove the setuid bit from check_icmp and grant cap_net_raw instead (for example setcap cap_net_raw+ep), which preserves raw-socket functionality while removing the elevated-privilege context during argument parsing; the trade-off is that this changes how the plugin must be packaged and installed on the host and must be validated against the monitoring agent's invocation path. Because the trigger requires an attacker to supply more than 65,535 host arguments or Host= entries, restricting who can execute check_icmp and keeping the plugin out of setuid-root mode on multi-user systems reduces exposure while patching is staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an integer overflow (CWE-190) that produces an out-of-bounds write (CWE-787) in the C argument parser of check_icmp, the ICMP reachability plugin built from the plugins-root directory because it needs raw-socket access. The number of hosts supplied on the command line (-H/--Host, repeated) or through an --extra-opts ini file with Host= entries is accumulated into an unsigned short; once more than 65,535 entries are counted the value wraps to a small number, so the hosts array sized from that wrapped count is far too small and each subsequent host entry is written beyond the allocated heap block. Because parsing happens in process_arguments() before main() calls setuid(getuid()), any corruption occurs while the process is still running as root on setuid-root deployments. The upstream commit c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a adds explicit checks comparing result.config.number_of_hosts against USHRT_MAX in both the argv and the --extra-opts parsing paths and aborts with a usage error instead of allowing the counter to overflow. The overflow length is attacker-controlled and the written content is partially attacker-influenced, but the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that turning the corruption into reliable code execution was not demonstrated; the specific heap layout and trigger mechanics beyond the host-count arithmetic are not described in the available sources. The CPE cpe:2.3:a:monitoring-plugins:monitoring-plugins:*:*:*:*:*:*:*:* matches the package generally, while the advisory pins the vulnerable range to the check_icmp binary from 3.0.0-rc1 through 3.0.0.
Know when Monitoring Plugins gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged access to a setuid-root binary (AV:L/PR:L); AC:H because reliable escalation from the heap overflow is undemonstrated and depends on heap state; full impact reflects best-case root compromise.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
Executive ViewAI
A high-severity heap corruption vulnerability in the check_icmp plugin (Monitoring Plugins 3.0.0-rc1 through 3.0.0) could allow a local low-privileged user to write out-of-bounds memory in a setuid-root process, potentially leading to privilege escalation. While no public exploit code or active exploitation has been identified, the risk is heightened on systems where this plugin is installed with setuid-root permissions, as it could be leveraged by an attacker with local access to gain elevated privileges and compromise sensitive monitoring infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include removing the setuid-root permission from check_icmp, restricting local access to trusted users, and monitoring for unusual invocation patterns of check_icmp with excessive host arguments.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Monitoring Plugins
View allCross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitori
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects th
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account
Exploit-DB