FastNetMon Community Edition through 1.2.9 incorrectly parses BGP path attributes when the extended length flag is set. The parsing routine reads only a single byte for the attribute value length, truncating the real length and mis‑interpreting remaining data as additional attributes. This flaw can trigger out-of-bounds memory accesses that may destabilise the daemon or allow malicious actors to crash the system. The vulnerability is an example of CWE-130 (Incorrect Length Calculation) and does not directly provide code execution capability but can be leveraged for service disruption.

The flaw affects the FastNetMon Community Edition software, specifically any release with a version number of 1.2.9 or earlier. No further vendor information is supplied beyond the project name, and no additional affected versions are identified.

The CVSS score of 6.5 categorises this out-of-bounds parsing flaw as a moderate‑severity issue. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog, indicating limited evidence of active exploitation. Attackers would need to send malformed BGP updates that set the extended‑length bit from a BGP‑speaking router reachable by the FastNetMon instance. Successfully parsing such a packet would trigger out-of-bounds memory access and could cause the daemon to crash, leading to service disruption for traffic monitoring.