FastNetMon Community Edition through release 1.2.9 decodes BGP NLRI messages without validating the prefix bit length. The vulnerable function reads a value directly from the network and uses it to determine the number of bytes for an IPv4 mask, leading to a stack‑based buffer overflow when the value exceeds 32. An attacker can craft a BGP UPDATE with an oversized prefix length, overwrite the stack, and achieve arbitrary code execution on the host running FastNetMon. This unchecked bit length also results in an out‑of‑bounds write due to the shift operation on values greater than 32.

FastNetMon Community Edition up to and including version 1.2.9. The issue is present in the source file bgp_protocol.cpp where the prefix_bit_length field from BGP packets is unchecked. No other products are affected.

The absence of input validation allows a stack corruption that can be leveraged to achieve remote code execution, so the overall risk is high. The CVSS score of 9.8 underscores the critical severity of this flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to send a malicious BGP UPDATE packet to the FastNetMon instance, which is typically reachable from other routers or the public internet. Once the packet is processed, the overflow can be triggered without additional authentication, making exploitation straightforward for attackers who can reach the BGP session.