CVE-2026-48684

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In processnetflowv9optionstemplate() (src/netflowplugin/netflowv9collector.cpp), the scope parsing loop (lines 224-229) iterates until scopesoffset reaches the attacker-controlled optionscopelength value, reading netflow9templateflowsetrecordt structures at each step. No bounds check validates that (zoneaddress + scopesoffset + sizeof(record)) stays within the flowset. The same issue affects the options field loop (lines 241-257) with optionlength. Furthermore, optionscopelength is not validated to be a multiple of sizeof(netflow9templateflowsetrecord_t), potentially causing misaligned reads. An attacker can trigger reads past the end of the UDP packet buffer.