FastNetMon Community Edition versions up to 1.2.9 incorrectly parse BGP path attributes when the extended length flag is set. The Parser reads only the low byte of a two‑byte length field, truncating the real length and mis‑interpreting remaining data as additional attributes. This flaw can trigger out‑of‑bounds memory accesses, potentially destabilizing the daemon or allowing malicious actors to crash the system. The vulnerability does not directly provide code execution capability but can be leveraged for service disruption.

The flaw affects the FastNetMon Community Edition software, specifically versions 1.0.0 through 1.2.9. No vendor identification is provided beyond the project name. Due to the lack of explicit version numbers other than the 1.2.9 ceiling, all releases before 1.3.0 are presumed vulnerable.

The CVSS score is not provided; the EPSS score is unavailable, but the issue is not listed in the CISA KEV catalog, suggesting limited publicly documented exploitation. Attackers would need to send crafted BGP messages with the extended length flag set to trigger the bug, typically from a malicious BGP speaker. Because the vulnerability leads to crashes rather than immediate code execution, the risk is primarily denial‑of‑service for network traffic monitoring services running FastNetMon.