Memory Corruption Vulnerability in Monitoring Plugins by Monitoring Plugins

CVE-2026-63418

What is CVE-2026-63418?

The Monitoring Plugins suite has a vulnerability in the check_icmp plugin, where it mistakenly handles the number of hosts supplied via command line options and configuration files. This issue arises from the limited size of an unsigned short data type, which cannot accommodate more than 65,535 hosts. When this limit is exceeded, the plugin allocates an undersized array for the host entries, leading to potential out-of-bounds writes. When check_icmp is executed with root privileges, a low-privileged attacker could exploit this flaw to corrupt heap memory. However, this vulnerability does not manifest reliable privilege escalation in all instances. Notably, installations using cap_net_raw file capabilities instead of setuid are not affected by the risks associated with this flaw. The issue has been addressed in version 3.0.1.

References