PT-2026-43310 · Unknown · Fastnetmon Community Edition

Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-48691

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FastNetMon Community Edition versions prior to 1.2.10

Description An integer overflow exists in the BGP AS PATH attribute encoder. The IPv4UnicastAnnounce::get attributes() function calculates the attribute length and stores it in a uint8 t field. Because a uint8 t only supports values from 0 to 255, an AS PATH containing more than 63 ASNs causes silent truncation. This truncated length is used for buffer sizing, but the full untruncated data is written, leading to a heap buffer overflow. Additionally, the path segment length field is also a uint8 t, which results in truncation when more than 255 ASNs are present.

Recommendations Update to version 1.2.10 or later.

Fix

Integer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-190

CWE-122

Related Identifiers

CVE-2026-48691

Affected Products

Fastnetmon Community Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-48691 · Security Note
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/bgp_protocol.hpp · Note
• https://github.com/pavel-odintsov/fastnetmon · Note
• https://t.me/cveNotify/164936 · Telegram Post
• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48691-bgp-as-path-overflow · Note
• https://i.redd.it/3dwfot8acp3h1.png · Reddit Post