CVE-2026-63418

The record

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

Affected packages

Related vulnerabilities

• CVE-2026-108324 Tanium addressed a denial of service vulnerability in Tanium Client. CWE-190
• CVE-2026-121219 Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker… CWE-190
• CVE-2026-121382 A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. CWE-190
• CVE-2026-120954 A weakness in the BSON library's handling of a specialized binary vector data type allows… CWE-190
• CVE-2026-121259 A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. CWE-190
• CVE-2026-40659 An integer overflow condition in the AMD Compressonator SDK could allow an attacker with… CWE-190
• CVE-2026-100493 An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an… CWE-190
• CVE-2026-58845 In multiple locations, there is a possible out of bounds write due to an integer overflow. CWE-190