Vulnerability Description
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.cpp), the scope parsing loop (lines 224-229) iterates until scopes_offset reaches the attacker-controlled option_scope_length value, reading netflow9_template_flowset_record_t structures at each step. No bounds check validates that (zone_address + scopes_offset + sizeof(record)) stays within the flowset. The same issue affects the options field loop (lines 241-257) with option_length. Furthermore, option_scope_length is not validated to be a multiple of sizeof(netflow9_template_flowset_record_t), potentially causing misaligned reads. An attacker can trigger reads past the end of the UDP packet buffer.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pavel-Odintsov | Fastnetmon | <= 1.2.9 |
Related Weaknesses (CWE)
References
- https://github.com/pavel-odintsov/fastnetmonProduct
- https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netfProduct
- https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48684-netflow-v9-options-oThird Party Advisory
FAQ
What is CVE-2026-48684?
CVE-2026-48684 is a vulnerability with a CVSS score of 6.5 (MEDIUM). FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.c...
How severe is CVE-2026-48684?
CVE-2026-48684 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48684?
Check the references section above for vendor advisories and patch information. Affected products include: Pavel-Odintsov Fastnetmon.