Quick answers
- Is CVE-2026-48684 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48684 being exploited in the wild.
- How severe is CVE-2026-48684?
- Informational severity, with a CVSS score of 7.5, published 26 May 2026.
- Which products and versions are affected?
- FastNetMon LTD FastNetMon Community Edition through 1.2.9.
- Is there a fix for CVE-2026-48684?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48684 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48684?
- Check whether you run FastNetMon LTD FastNetMon Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read exists in the process_netflow_v9_options_template() function within src/netflow_plugin/netflow_v9_collector.cpp. The vulnerability is caused by a lack of bounds checking in two loops (scope parsing and options parsing) that iterate based on attacker-controlled length fields (option_scope_length and option_length). An attacker can provide inflated length values that cause the parser to read past the end of the UDP packet buffer. Additionally, a lack of alignment validation can cause misaligned reads, leading to crashes on certain architectures. This is a single-packet, unauthenticated attack reachable via the default NetFlow port (UDP 2055).
Affected products
- FastNetMon LTD FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: disclosed: Lorikeet Security notified FastNetMon LTD
- 2026-05-26: advisory: CVE-2026-48684 published by NVD/MITRE