FastNetMon Community Edition, up through version 1.2.9, contains an off‑by‑one error in the dynamic_binary_buffer_t class that allows an attacker to write one byte past the end of a heap‑allocated buffer. The flaw exists in several public methods that are used for BGP, NetFlow, sFlow, and IPFIX message handling and construction. By exploiting the incorrect bounds check, an attacker who can send these protocol messages can corrupt heap metadata and potentially obtain arbitrary code execution on the FastNetMon host. The defect aligns with key buffer manipulation weaknesses, namely CWE‑122, CWE‑193, and CWE‑787.

Any deployment of FastNetMon Community Edition whose installed version is 1.2.9 or earlier. The vulnerability applies to all builds that include the dynamic_binary_buffer.hpp implementation; no other vendor or product names are specified.

The flaw is a severe heap overflow that can lead to remote code execution. The CVSS score of 9.8 indicates critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to send specially crafted network traffic (NetFlow, sFlow, IPFIX, or BGP) to a reachable FastNetMon instance; thus exposure depends on network exposure and firewall rules. The absence of a public exploit does not mitigate the inherent risk of the vulnerability.