The vulnerability arises from an out‑of‑bounds read in the IPv4 packet parser of FastNetMon Community Edition versions up to 1.2.9, where the code advances the packet pointer using the IHL field without validating the header length or ensuring that enough bytes exist. This flaw can expose up to 60 bytes of memory content, potentially leaking sensitive information such as configuration data or credentials.

Affected systems are the FastNetMon Community Edition tool distributed by the open‑source project led by Pavel Odintsov. Versions 1.2.9 and earlier are vulnerable; any deployments of that software will be impacted unless the code has been manually patched.

The over‑read can expose up to 60 bytes of memory content, potentially leaking sensitive data such as configuration or credentials. Since the flaw is triggered by any packet captured on an interface, a malicious network actor could craft a packet with a deliberately small or excessively large IHL value to cause the read. No exploit code has been published and the vulnerability is not listed in CISA KEV, and no EPSS score is available, indicating that public exploitation activity is currently low. Nevertheless, the lack of a patch in the current release means that the vulnerability remains actionable and could be used for information disclosure if a suitable threat actor can supply crafted packets to the monitored interface.