CVE-2026-48689 is an off-by-one heap-based buffer overflow vulnerability in FastNetMon Community Edition (through 1.2.9) within the dynamic_binary_buffer_t class. Five methods incorrectly check buffer boundaries using 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)', allowing a single byte to be written past the allocated heap buffer. This class is widely used in processing BGP messages, NetFlow templates, and Flow Spec NLRI, making the vulnerability broadly exploitable via network traffic. An attacker capable of sending crafted NetFlow, sFlow, IPFIX, or BGP packets to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. The append_byte() method uses the correct bounds check, highlighting the inconsistency. No patch or official remediation is currently documented.

Successful exploitation allows an unauthenticated attacker to send specially crafted network traffic to a vulnerable FastNetMon instance and trigger a heap-based buffer overflow. This can lead to arbitrary code execution with the privileges of the FastNetMon process, compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects core network traffic processing components, increasing the risk of impactful exploitation in environments using FastNetMon for network monitoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict or filter untrusted NetFlow, sFlow, IPFIX, and BGP traffic to FastNetMon instances to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.