CVE-2026-48686 is a critical stack based buffer overflow (CVSS 9.8) in the BGP NLRI decoder of FastNetMon Community Edition through 1.2.9. A prefix length from the packet is used without a check. Upgrade to FastNetMon 2.0.380 or later, which the researcher's related write ups name as the fix release.
What's affected
FastNetMon Community Edition through 1.2.9. The vulnerable function is decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp.
The researcher's pages for related FastNetMon CVEs say the vendor shipped fixes in FastNetMon 2.0.380. The page for this CVE lists 2.0.380 only in its timeline, so confirm in the vendor release notes that your build includes the fix.
How to check if you're exposed
List FastNetMon installs and read the version. Community Edition through 1.2.9 is the stated range.
dpkg -l | grep -i fastnetmon
rpm -qa | grep -i fastnetmon
Also list who can send BGP, NetFlow, sFlow or IPFIX traffic to the collector.
What to do now
- Find every FastNetMon Community Edition install and its version.
- Upgrade to 2.0.380 or later, after confirming in the vendor notes that it covers this CVE.
- Allow BGP sessions and flow exports only from known peers and exporters, using router and host firewall rules.
- Run the service as an unprivileged user and watch it for crashes, which can hint at malformed input.
Why it matters
The classes are CWE-120, copy of a buffer without checking input size, and CWE-787, out of bounds write. The record explains the cause: the decoder reads a prefix bit length from the packet and does not check that it is 32 or less for IPv4. That value sets how many bytes get copied into a four byte stack variable, so a large length overflows it by up to 28 bytes.
The researcher who found it notes the default build does not enable common protections such as stack canaries, which makes memory bugs easier to turn into code execution. That is their observation, and your packaged build may differ. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48686 is a handy place to follow later updates.
Quick check
Is the packet source trusted?
The record says an attacker reaches the decoder through BGP traffic. Limiting peers lowers exposure but does not replace the upgrade.
Sources
Last reviewed: 19 October 2026.
