An integer overflow in the FastNetMon Community Edition’s BGP AS_PATH encoder allows an attacker to craft a BGP UPDATE message with an AS_PATH containing more than 63 ASNs. The encoder treats the length of the path as a uint8_t field, truncating values above 255. The truncated length is then used to size a heap buffer, while the full untruncated attribute is copied into that buffer, causing a heap buffer overflow. The likely consequences of the buffer overflow include potential arbitrary code execution or denial of service, depending on how the overflow is exploited.

FastNetMon Community Edition software versions up to and including 1.2.9 are affected. The issue resides in src/bgp_protocol.hpp and affects the construction of IPv4UnicastAnnounce attributes during BGP message processing.

No EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog, indicating that there is no documented exploitation in the wild yet. However, the severity of a heap buffer overflow in a networking daemon is high, and the lack of public exploitation does not reduce the potential damage. Based on the description, the likely attack vector is that an attacker could deliver crafted BGP UPDATE packets from any source with network reachability to the FastNetMon instance to trigger the overflow.