What is the CVSS score of EUVD-2026-31956?

EUVD-2026-31956 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FastNetMon are affected by EUVD-2026-31956?

FastNetMon Community Edition through version 1.2.9 contains a critical remote code execution vulnerability (CVSS 9.8) reachable by unauthenticated network attackers through standard DDoS telemetry…

How to fix or mitigate EUVD-2026-31956?

No public exploit identified at time of analysis, but vulnerability severity and absence of patch warrant immediate action. Within 24 hours: Identify all FastNetMon Community Edition instances running version 1.2.9 or earlier; assess network exposure to external telemetry sources. Within 7 days: Restrict NetFlow, sFlow, IPFIX, and BGP traffic to authorized monitoring sources via firewall rules; implement network segmentation to minimize exposure. Within 30 days: Execute migration plan to patched versions when released or transition to alternative DDoS detection platform; establish continuous monitoring of vendor advisory channels.

FastNetMon EUVD-2026-31956

| CVE-2026-48689 CRITICAL

Out-of-bounds Write (CWE-787)

2026-05-26 mitre

GHSA-5444-f65m-f3c8

RCE Buffer Overflow Memory Corruption N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 26, 2026 - 21:28 vuln.today

CVSS changed

May 26, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.

AnalysisAI

Remote code execution in FastNetMon Community Edition through 1.2.9 stems from an off-by-one heap write in the pervasively-used dynamic_binary_buffer_t class, reachable by anyone who can send NetFlow, sFlow, IPFIX, or BGP traffic to the DDoS-detection appliance. Because the flawed buffer is exercised during BGP encoding/decoding, NetFlow template parsing, and Flow Spec NLRI construction, an unauthenticated network attacker can corrupt adjacent heap metadata and potentially execute arbitrary code. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

FastNetMon is an open-source/commercial DDoS detection and mitigation tool that ingests high-volume flow telemetry (NetFlow v5/v9, IPFIX, sFlow) and speaks BGP/Flow Spec to trigger blackholing or filtering. The defect is a classic CWE-787 out-of-bounds write: in src/dynamic_binary_buffer.hpp, five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) guard copies with 'if (offset + length > maximum_internal_storage_size + 1)' rather than the correct '> maximum_internal_storage_size', permitting exactly one byte to be written past the end of the heap allocation. The append_byte() method uses the correct check, which both confirms the bug is an inconsistency rather than intended slack and narrows the root cause. Because dynamic_binary_buffer_t backs the binary serialization paths for multiple wire protocols, the off-by-one is triggerable from several distinct, attacker-influenced parsing/encoding routines. The CPE string supplied (cpe:2.3:a:n/a:n/a:*) is a malformed placeholder and does not identify the product, so exact affected-package identification relies on the description.

RemediationAI

No vendor-released patch version is identified at time of analysis - the references point to the upstream repository and the affected header file rather than to a tagged fixed release, so monitor the FastNetMon project (https://github.com/pavel-odintsov/fastnetmon) for a release above 1.2.9 that corrects the five bounds checks from '> maximum_internal_storage_size + 1' to '> maximum_internal_storage_size', and apply it as the primary fix. Until a patched build is available, reduce exposure with network-layer controls: restrict the NetFlow/sFlow/IPFIX collector ports and the BGP listener (TCP/179) with firewall ACLs so only known, trusted exporters and BGP peers can reach the instance - accepting that this breaks telemetry or peering from any source you forget to allowlist; place the FastNetMon management/collector interface on an isolated network segment unreachable from untrusted hosts; and consider temporarily disabling BGP/Flow Spec announcement features if they are not in active use, with the trade-off that automated mitigation actions will stop. Organizations building from source may also apply the one-line correction to dynamic_binary_buffer.hpp directly. Consult the third-party technical write-up at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48689-dynamic-buffer-off-by-one and the VulDB advisory at https://vuldb.com/vuln/365762 for further detail.