FastNetMon Community Edition versions up to 1.2.9 contain an integer overflow in the packet capture buffer allocation. The allocate_buffer() function calculates the memory size for captured packets using 32‑bit unsigned arithmetic, multiplying the requested number of packets by the size of each packet header plus the maximum packet payload. When the number of packets requested exceeds about 2,832,542, the multiplication wraps around, allocating a block that is far smaller than intended. Subsequent write_packet() calls then write beyond the end of this block, corrupting the heap. The overflow originates from the ban_details_records_count configuration parameter, parsed with atoi() without bounds checking, allowing an attacker who can influence this setting to trigger the overflow. While the documentation does not explicitly state that this corruption leads to code execution, the resulting heap corruption could, if an attacker can control the memory layout, be exploited to achieve arbitrary code execution – a common consequence of unchecked heap writes, but this outcome is inferred rather than confirmed.

FastNetMon Community Edition releases up to and including 1.2.9 are affected. The vulnerability is present in the packet_storage.hpp source file distributed with the community edition. No other vendors or product lines are identified as impacted.

The CVSS score of 7.1 indicates a high severity issue. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit. The attack vector depends on an attacker’s ability to alter the ban_details_records_count setting; if the configuration is editable by untrusted users, the risk is elevated. Based on the description, it is inferred that the heap corruption could be leveraged to achieve arbitrary code execution, a typical exploit path for unchecked memory writes, but this inference is based solely on the nature of the overflow rather than an explicit statement of exploitation. The instability and potential for denial of service also make this vulnerability significant.