EUVD-2026-31839
GHSA-242v-wx3w-qx8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow_v9_collector.cpp, the Data template branch (lines 1695-1702) iterates over flow records without performing a per-iteration bounds check against the packet end pointer. In contrast, the Options template branch (lines 1709-1719) correctly checks 'if (pkt + offset + field_template->total_length > packet_end)' before each iteration. The Data branch omits this check entirely. Since template definitions are sent by the network peer (and are unauthenticated UDP), an attacker can craft templates that cause the parser to read arbitrary memory past the packet buffer. This can leak sensitive memory contents or cause a crash.
AnalysisAI
Out-of-bounds memory read in FastNetMon Community Edition through 1.2.9 exposes sensitive process memory and can crash the collector when processing crafted NetFlow v9 packets. The NetFlow v9 data flowset parser in src/netflow_plugin/netflow_v9_collector.cpp omits the per-iteration boundary check present in the sibling Options template branch, allowing a network-adjacent attacker who can deliver UDP NetFlow v9 packets to the collector to supply malicious template definitions that drive the parser past the end of the packet buffer. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a security researcher blog post at lorikeetsecurity.com documents the code-level flaw, raising the disclosure surface.
Technical ContextAI
FastNetMon is an open-source high-performance DDoS detection tool that processes raw NetFlow v9 traffic. NetFlow v9 (RFC 3954) is a template-based flow export protocol transmitted over UDP - critically, template records that define field layouts are sent by the exporting network peer without any cryptographic authentication. The vulnerability is rooted in CWE-125 (Out-of-Bounds Read): in netflow_v9_collector.cpp the Options template branch correctly guards each field iteration with 'if (pkt + offset + field_template->total_length > packet_end)' before advancing, but the Data template branch (lines 1695-1702) lacks this per-iteration check entirely. Because template definitions originate from the network peer and are trusted implicitly, an attacker controlling what the collector receives can define templates with inflated field lengths that cause the loop to read arbitrarily beyond the allocated packet buffer into adjacent heap or stack memory. The CPE string provided by MITRE/NVD is listed as 'n/a' - affected product identification is derived from the description and upstream repository reference rather than a formally mapped CPE entry.
RemediationAI
No vendor-released patch version has been confirmed in the available data. The upstream repository at https://github.com/pavel-odintsov/fastnetmon should be monitored for a fix commit or tagged release that adds the missing per-iteration bounds check 'if (pkt + offset + field_template->total_length > packet_end)' to the Data template branch in netflow_v9_collector.cpp to mirror the correct logic already present in the Options template branch. Until a patch is available, defenders should restrict access to the FastNetMon NetFlow collection UDP port (typically 2055) using host-based firewall rules or network ACLs to allow only trusted, known NetFlow exporter IP addresses - this directly addresses the unauthenticated UDP template injection path. Organizations unable to restrict source IPs should consider temporarily disabling NetFlow v9 ingestion if alternatives such as sFlow or NetFlow v5 (which uses fixed-length records and lacks the template mechanism) are available, trading feature coverage for exposure reduction. Monitoring the lorikeetsecurity.com disclosure at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48683-netflow-v9-data-oob may surface additional remediation guidance as the researcher disclosure matures.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today