FastNetMon Community Edition up to 1.2.9 includes an out‑of‑bounds read in the NetFlow v9 data flowset processor. The code that parses Data templates fails to perform a per‑iteration bounds check, allowing memory beyond the packet buffer to be accessed. An attacker could thus read arbitrary memory contents or cause the program to terminate unexpectedly, exposing sensitive internal data or rendering the monitoring system unavailable.

All installations of FastNetMon Community Edition version 1.2.9 or earlier, which use the NetFlow v9 collector module, are affected.

The vulnerability can be exploited via crafted unauthenticated UDP NetFlow v9 packets sent from a network peer. Precise exploitation would require an attacker to send a malicious template definition to trigger the out‑of‑bounds read, which can then expose memory contents or crash the collector. The EPSS score is not available, but the CVE is not listed in the CISA KEV catalogue. The lack of authentication for NetFlow traffic and the direct memory read suggest a high risk of exploitation, particularly in environments where the collection module is exposed to untrusted networks. No confirmed public exploitation has been reported yet.