An integer overflow occurs in FastNetMon Community Edition through version 1.2.9 when allocating memory for captured packets. The allocate_buffer() function multiplies buffer_size_in_packets by the size of a single packet header and payload using 32‑bit unsigned arithmetic. With the default maximum packet size of 1500 bytes and a 16‑byte header, each packet requires about 1516 bytes. When buffer_size_in_packets exceeds roughly 2,832,542 the multiplication overflows, yielding a memory block that is far smaller than intended. Subsequent calls to write_packet() then write past the end of this block, corrupting the heap. Because the buffer_size_in_packets value is derived from the ban_details_records_count configuration parameter and parsed with atoi() without bounds checking, an attacker who can influence that configuration can trigger the overflow and cause heap corruption, potentially leading to arbitrary code execution.

FastNetMon Community Edition versions up to and including 1.2.9 are affected. The vulnerability exists in the packet_storage.hpp source code that is distributed in the community edition release. No other vendors or product lines are listed as impacted.

The CVSS score is not publicly available, but the nature of the overflow and the complete lack of input validation make this vulnerability a critical security risk. Heap corruption can be leveraged to execute arbitrary code, which may grant the attacker full control over the host. No public exploit has been reported, and the vulnerability is not listed in the CISA KEV catalog, but the EPSS metric is unavailable. The attack is likely local or remote depending on whether the attacker can modify the ban_details_records_count setting; if the configuration is editable by untrusted users, the risk escalates. Adequate hardening and patching are strongly advised.