Title: FastNetMon Community Edition, Description: FastNetMon Community Edition hasta la versión 1.2.9 contiene una vulnerabilidad de desbordamiento de entero en la asignación del búfer de captura de paquetes. En src/packet_storage.hpp, la función allocate_buffer() calcula memory_size_in_bytes como 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t)' utilizando aritmética de entero sin signo (32 bits). Con max_captured_packet_size=1500 y sizeof(fastnetmon_pcap_pkthdr_t)=16, cada paquete requiere aproximadamente 1516 bytes. Si buffer_size_in_packets excede aproximadamente 2.832.542, la multiplicación se desborda, lo que resulta en una asignación mucho menor de lo esperado. Las llamadas posteriores a write_packet() entonces escriben más allá del búfer asignado, causando corrupción de la pila. El valor de buffer_size_in_packets se deriva del parámetro de configuración ban_details_records_count, que se analiza utilizando atoi() sin verificación de desbordamiento.

{"timestamp":"2026-05-26T21:01:52.796415Z","id":"CVE-2026-48690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OR
          *cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:* versions up to (including) 1.2.9

MITRE: https://github.com/pavel-odintsov/fastnetmon Types: Product

MITRE: https://github.com/pavel-odintsov/fastnetmon/blob/master/src/packet_storage.hpp Types: Product

MITRE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48690-packet-storage-integer-overflow Types: Third Party Advisory

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-122

CWE-190

FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t)' using unsigned int (32-bit) arithmetic. With max_captured_packet_size=1500 and sizeof(fastnetmon_pcap_pkthdr_t)=16, each packet requires approximately 1516 bytes. If buffer_size_in_packets exceeds approximately 2,832,542, the multiplication overflows, resulting in a much smaller allocation than expected. Subsequent write_packet() calls then write past the allocated buffer, causing heap corruption. The buffer_size_in_packets value is derived from the ban_details_records_count configuration parameter, which is parsed using atoi() with no overflow checking.

https://github.com/pavel-odintsov/fastnetmon

https://github.com/pavel-odintsov/fastnetmon/blob/master/src/packet_storage.hpp

https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48690-packet-storage-integer-overflow