{"id":"UBUNTU-CVE-2026-48684","details":"FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.cpp), the scope parsing loop (lines 224-229) iterates until scopes_offset reaches the attacker-controlled option_scope_length value, reading netflow9_template_flowset_record_t structures at each step. No bounds check validates that (zone_address + scopes_offset + sizeof(record)) stays within the flowset. The same issue affects the options field loop (lines 241-257) with option_length. Furthermore, option_scope_length is not validated to be a multiple of sizeof(netflow9_template_flowset_record_t), potentially causing misaligned reads. An attacker can trigger reads past the end of the UDP packet buffer.","modified":"2026-06-15T20:15:13.597765323Z","published":"2026-05-26T16:16:00Z","upstream":["CVE-2026-48684"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-48684"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-48684"},{"type":"REPORT","url":"https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48684-netflow-v9-options-oob"},{"type":"REPORT","url":"https://github.com/pavel-odintsov/fastnetmon/commit/aa1069abaa8624e50b5d0c6c8ccd0f5d9ddc111e"},{"type":"REPORT","url":"https://github.com/pavel-odintsov/fastnetmon/pull/1057"},{"type":"REPORT","url":"https://github.com/pavel-odintsov/fastnetmon"},{"type":"REPORT","url":"https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netflow_v9_collector.cpp"}],"affected":[{"package":{"name":"fastnetmon","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/fastnetmon?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3+dfsg-3","1.1.3+dfsg-4","1.1.3+dfsg-6build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.1.3+dfsg-6build1","binary_name":"fastnetmon"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48684.json"}},{"package":{"name":"fastnetmon","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/fastnetmon?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.4-1","1.1.4-1build3","1.1.4-1build4","1.1.4-1build5","1.1.4-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"fastnetmon","binary_version":"1.1.4-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48684.json"}},{"package":{"name":"fastnetmon","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/fastnetmon?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-1","1.2.6-1","1.2.6-1build1","1.2.6-1build2","1.2.6-1build3","1.2.6-1build4","1.2.6-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"fastnetmon","binary_version":"1.2.6-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48684.json"}},{"package":{"name":"fastnetmon","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/fastnetmon?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.8-1build1","1.2.8-1build2","1.2.8+git20250911-1"],"ecosystem_specific":{"binaries":[{"binary_name":"fastnetmon","binary_version":"1.2.8+git20250911-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48684.json"}},{"package":{"name":"fastnetmon","ecosystem":"Ubuntu:Pro:26.04:LTS","purl":"pkg:deb/ubuntu/fastnetmon?arch=source&distro=esm-apps%2Fresolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.8+git20250911-1","1.2.8+git20250911-1build1","1.2.8+git20250911-1build2","1.2.8+git20250911-2","1.2.8+git20250911-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.2.8+git20250911-2ubuntu0.1~esm1","binary_name":"fastnetmon"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48684.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"type":"Ubuntu","score":"medium"}]}