https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 10:45:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-321579 EUVD-2026-321579 https://cve.radiocsirt.org/vuln/euvd-2026-321579 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48689 <p>FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form &#39;if (offset + length &gt; maximum_internal_storage_size + 1)&#39; instead of the correct &#39;if (offset + length &gt; maximum_internal_storage_size)&#39;. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.</p> <p>FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form &#39;if (offset + length &gt; maximum_internal_storage_size + 1)&#39; instead of the correct &#39;if (offset + length &gt; maximum_internal_storage_size)&#39;. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48689 https://cve.radiocsirt.org/vuln/ghsa-5444-f65m-f3c8 <p>FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form &#39;if (offset + length &gt; maximum_internal_storage_size + 1)&#39; instead of the correct &#39;if (offset + length &gt; maximum_internal_storage_size)&#39;. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.</p> <p>FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form &#39;if (offset + length &gt; maximum_internal_storage_size + 1)&#39; instead of the correct &#39;if (offset + length &gt; maximum_internal_storage_size)&#39;. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.</p> https://cve.radiocsirt.org/vuln/ghsa-5444-f65m-f3c8 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48689 <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: fastnetmon, Ubuntu:25.10: fastnetmon, Ubuntu:26.10: fastnetmon, Ubuntu:Pro:26.04:LTS: fastnetmon</p> <p>FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form &#39;if (offset + length &gt; maximum_internal_storage_size + 1)&#39; instead of the correct &#39;if (offset + length &gt; maximum_internal_storage_size)&#39;. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.</p> <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: fastnetmon, Ubuntu:25.10: fastnetmon, Ubuntu:26.10: fastnetmon, Ubuntu:Pro:26.04:LTS: fastnetmon</p> <p>FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form &#39;if (offset + length &gt; maximum_internal_storage_size + 1)&#39; instead of the correct &#39;if (offset + length &gt; maximum_internal_storage_size)&#39;. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48689