CVE-2026-48686

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the BGP packet (line 99) without validating it is <= 32 for IPv4 prefixes. This value is passed to how_much_bytes_we_need_for_storing_certain_subnet_mask() which computes ceil(prefix_bit_length / 8), returning up to 32 bytes for a prefix_bit_length of 255. The result is used as the length argument to memcpy() (line 106), which copies into a 4-byte uint32_t stack variable (prefix_ipv4). This causes a stack buffer overflow of up to 28 bytes, which can be exploited for arbitrary code execution. Additionally, the unvalidated prefix_bit_length is passed to convert_cidr_to_binary_netmask_local_function_copy() (line 111), where a shift of (32 - cidr) with cidr > 32 causes undefined behavior.

• CWE-120
• CWE-787

• https://github.com/pavel-odintsov/fastnetmonProduct
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/bgp_protocol.cppProduct
• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48686-bgp-nlri-stack-overflowThird Party Advisory

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4868GitLab has remediated an issue in GitLab EE affecting all ve…8.2
• CVE-2026-48681OpenStack Ironic through before 35.0.2 allows file overwrite…8.1
• CVE-2026-48682FastNetMon Community Edition through 1.2.9 contains an out-o…5.9
• CVE-2026-48683FastNetMon Community Edition through 1.2.9 contains an out-o…6.5
• CVE-2026-48684FastNetMon Community Edition through 1.2.9 contains an out-o…6.5
• CVE-2026-48685FastNetMon Community Edition through 1.2.9 has out-of-bounds…6.5
• CVE-2026-48687FastNetMon Community Edition through 1.2.9 contains an OS co…9.8
• CVE-2026-48688FastNetMon Community Edition through 1.2.9 contains multiple…7.5
• CVE-2026-48689FastNetMon Community Edition through 1.2.9 contains an off-b…9.8
• CVE-2026-48690FastNetMon Community Edition through 1.2.9 contains an integ…7.1
• CVE-2026-48691FastNetMon Community Edition through 1.2.9 contains an integ…9.8
• CVE-2026-48692FastNetMon Community Edition through 1.2.9 exposes a gRPC AP…8.1