Threats affecting pkg:github/monitoring-plugins/monitoring-plugins

CVE-2026-63418 is an integer overflow vulnerability in monitoring-plugins' check_icmp component versions from 3.0.0-rc1 up to but not including 3.0.1. The flaw occurs because the number of hosts is stored in an unsigned short, causing a wraparound when more than 65,535 hosts are specified. This leads to an undersized allocation and out-of-bounds writes before privilege dropping. On systems where check_icmp is setuid root, this can allow a local low-privileged attacker to corrupt heap memory with elevated privileges. The issue is fixed in version 3.0.1.