FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds read vulnerabilities in the BGP MP_REACH_NLRI IPv6 attribute decoder. The decode_mp_reach_ipv6() function fails to validate buffer boundaries when casting raw pointers and when using attacker-controlled length fields to compute memcpy sizes. This allows an attacker to craft a BGP packet that causes the program to read memory beyond the intended buffer, potentially exposing sensitive system or configuration data and providing information that could aid further attacks.

The vulnerability affects FastNetMon Community Edition versions up to and including 1.2.9. No other products or versions were listed as impacted.

An attacker who can send malicious BGP messages to a vulnerable FastNetMon instance can trigger the out-of-bounds reads. Because the bug originates from parsing a network protocol, it can be exercised remotely from the outside world. The resulting memory disclosures could reveal confidential information that may be leveraged for subsequent attacks. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. The CVSS score is not provided in the input, but the presence of a remote, user-controlled input that leads to a data leak suggests a moderate to high confidentiality risk. No special conditions are required other than the ability to inject crafted BGP traffic.