CVE-2026-48691

Katalog CVE

CVSS 9.8 · Critical EPSS 0,57%

Kerentanan Integer Overflow or Wraparound pada pavel-odintsov fastnetmon. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)' and stores it in a uint8_t field (line 600-605). Since uint8_t can only hold values 0-255, an AS_PATH containing more than 63 ASNs (2 + 64*4 = 258 > 255) causes silent truncation. The truncated length is used for buffer sizing, while the actual data written is the full untruncated amount, resulting in a heap buffer overflow. Similarly, the path_segment_length field at line 621 is also uint8_t, truncating with more than 255 ASNs.

Rincian

Terbit di NVD

26 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48691-bgp-as-path-overflow advisory pihak ketiga
• https://github.com/pavel-odintsov/fastnetmon product
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/bgp_protocol.hpp product