PT-2026-43275 · Unknown · Fastnetmon Community Edition

Published 2026-05-26 · Updated 2026-05-28 · CVE-2026-48688

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FastNetMon Community Edition versions prior to 1.2.10

Description Multiple out-of-bounds reads exist in the BGP MP REACH NLRI IPv6 attribute decoder. The decode mp reach ipv6() function in src/bgp protocol.cpp casts raw pointers to structure types without verifying sufficient data exists. It uses the attacker-controlled length of next hop field to determine memcpy size and computes prefix length by dereferencing a pointer calculated from multiple attacker-controlled offsets without bounds validation. This prefix length is subsequently used to calculate number of bytes required for prefix, which serves as a memcpy length without checking the remaining buffer size. This issue can cause the defense stack to crash if BGP is peered for flowspec DDoS mitigation.

Recommendations Update to version 1.2.10 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-48688

Affected Products

Fastnetmon Community Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-48688 · Security Note
• https://github.com/pavel-odintsov/fastnetmon · Note
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/bgp_protocol.cpp · Note
• https://i.redd.it/3dwfot8acp3h1.png · Reddit Post
• https://twitter.com/disismohi/status/2059905874022277335 · Twitter Post
• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48688-bgp-mp-reach-nlri-ipv6 · Note