FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds read vulnerabilities in the BGP MP_REACH_NLRI IPv6 attribute decoder. The decode_mp_reach_ipv6() function fails to validate buffer boundaries when casting raw pointers and when using attacker-controlled length fields to compute memcpy sizes. This allows an attacker to craft a BGP packet that causes the program to read memory beyond the intended buffer, potentially exposing sensitive system or configuration data and providing information that could aid further attacks.

The vulnerability affects FastNetMon Community Edition versions up to and including 1.2.9. No other products or versions were listed as impacted.

Based on the description, the likely attack vector is remote injection of crafted BGP packets over the network to a vulnerable FastNetMon instance. An attacker who can send these malicious BGP messages can trigger the out-of-bounds reads. Because the bug originates from parsing a network protocol, it can be exercised remotely from the outside world. The resulting memory disclosures could reveal confidential information that may be leveraged for subsequent attacks. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. The CVSS score is 7.5, reflecting a high severity. No special conditions are required other than the ability to inject crafted BGP traffic.