CVE-2026-48690

FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packetstorage.hpp, the allocatebuffer() function computes memorysizeinbytes as 'buffersizeinpackets * (maxcapturedpacketsize + sizeof(fastnetmonpcappkthdrt)) + sizeof(fastnetmonpcapfileheadert)' using unsigned int (32-bit) arithmetic. With maxcapturedpacketsize=1500 and sizeof(fastnetmonpcappkthdrt)=16, each packet requires approximately 1516 bytes. If buffersizeinpackets exceeds approximately 2,832,542, the multiplication overflows, resulting in a much smaller allocation than expected. Subsequent writepacket() calls then write past the allocated buffer, causing heap corruption. The buffersizeinpackets value is derived from the bandetailsrecordscount configuration parameter, which is parsed using atoi() with no overflow checking.