{"id":"DEBIAN-CVE-2026-48689","details":"FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length \u003e maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length \u003e maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.","modified":"2026-09-14T17:03:16.047144739Z","published":"2026-05-26T19:16:28.663Z","upstream":["CVE-2026-48689"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-48689"}],"affected":[{"package":{"name":"fastnetmon","ecosystem":"Debian:13","purl":"pkg:deb/debian/fastnetmon?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-0+deb13u1"}]}],"versions":["1.2.8+git20250911-1","1.2.8+git20250911-2","1.2.8-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48689.json"}},{"package":{"name":"fastnetmon","ecosystem":"Debian:14","purl":"pkg:deb/debian/fastnetmon?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1"}]}],"versions":["1.2.8+git20250911-1","1.2.8+git20250911-2","1.2.8-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48689.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}