CVE-2026-48691 is an integer overflow and heap buffer overflow vulnerability in FastNetMon Community Edition through version 1.2.9. The issue occurs in the BGP AS_PATH attribute encoder within the IPv4UnicastAnnounce::get_attributes() function. Specifically, the attribute_length field is stored as a uint8_t, which can only hold values up to 255. When the AS_PATH contains more than 63 ASNs, the computed length exceeds 255 but is truncated, causing a mismatch between the buffer size and the actual data written. This results in a heap buffer overflow, potentially leading to memory corruption. The vulnerability is classified under CWE-190 (Integer Overflow) and CWE-122 (Heap-based Buffer Overflow). The CVSS v3.1 base score is 7.3, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to heap buffer overflow, which may cause memory corruption. This can potentially allow an attacker to execute arbitrary code, cause a denial of service, or impact the confidentiality, integrity, and availability of the affected system. The CVSS score of 7.3 indicates a high severity impact. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, cautious handling of BGP AS_PATH inputs and limiting exposure of vulnerable FastNetMon instances to untrusted networks may reduce risk.