CVE-2026-48684 is an out-of-bounds read vulnerability in FastNetMon Community Edition (≤1.2.9) within the NetFlow v9 options template parser. Specifically, in the function process_netflow_v9_options_template(), loops parsing the option_scope_length and option_length fields do not perform adequate bounds checking to ensure that reads stay within the packet buffer. Additionally, option_scope_length is not validated to be a multiple of the expected record size, potentially causing misaligned memory reads. An attacker can craft malicious UDP packets to trigger reads past the buffer boundary, leading to potential information disclosure or application crashes. The vulnerability is tracked as CWE-125 (Out-of-bounds Read).

The vulnerability allows an unauthenticated attacker to send specially crafted NetFlow v9 UDP packets to the FastNetMon Community Edition server, causing out-of-bounds reads. This may result in partial information disclosure or denial of service due to application instability or crashes. The CVSS score of 6.5 reflects a medium severity with low complexity and no privileges required. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Users should monitor the vendor's communications for updates and consider applying any future patches promptly. In the meantime, restricting access to the NetFlow UDP port from untrusted sources may reduce exposure.