CVE-2026-48686 FastNetMon BGP NLRI Decoder Stack Overflow RCE Vulnerability

Vulnerability Overview CVE-2026-48686: 28-byte Stack Overflow in FastNetMon BGP NLRI Decoder CVSS Score: 9.8 (Critical) CWE: CWE-787 (Out-of-bounds Write), CWE-120 (Buffer Copy without Checking Size) Affected Versions: FastNetMon Community Edition <= 1.2.9 Vulnerability Location: , function , lines 93-111 Attack Vector: Remote (via GoBGP BGP peer) Discoverer: Lorikeet Security Impact Vulnerability Description: In the function, the prefix bit length is read from the BGP NLRI byte stream, a byte count is derived, and is executed to copy that byte count into a fixed 4-byte variable on the stack. There is no boundary check between "reading 1 byte from the wire" and "copying many bytes to the stack." Specific Details: For IPv4 NLRI, the prefix bit length must be in the range [0, 32]. If an attacker sets it to 255, the helper function calculates . The target variable is exactly 4 bytes. writes 32 bytes into a 4-byte slot, overflowing by 28 bytes. Remote Code Execution: The default FastNetMon CMake build lacks security flags (e.g., , , , ), has no stack canary to detect overflow, no FORTIFY-enhanced to reject oversized copies, and the binary is at a static base address. 20 bytes are sufficient to overwrite the saved return address with attacker-controlled values. Remediation Direct Fix: Add a conditional check at the top of the function to ensure does not exceed 32 bits. Structural Improvement: Avoid using to a fixed-size stack variable; instead, use a dynamically sized destination. The copy length should be . Compilation Flags: Add , , to CFLAGS and to LDFLAGS. Compensating Controls: - Restrict the BGP peer set to trusted peers. - Rebuild FastNetMon with hardening flags. - Run FastNetMon as a privilege-separated user. - Monitor BGP session logs for malformed UPDATE messages or abnormal NLRI lengths. - Disable BGP integration if not in use. Disclosure Timeline 2026-04-25: Vulnerability discovered during source code audit of FastNetMon Community Edition 1.2.9 by Lorikeet Security. 2026-04-25: CVE ID requested from MITRE. 2026-04-25: Vendor (Pavel Odintsov / FastNetMon LTD) notified. 2026-05-22: CVE-2026-48686 assigned by MITRE. TBD: Vendor response. TBD: Vulnerability publication.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-48686 FastNetMon BGP NLRI Decoder Stack Overflow RCE Vulnerability