Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63418— Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary

Quick assessment

Affected
monitoring-plugins monitoring-plugins
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Monitoring Plugins 是一套用于监控应用程序的插件套件。在 3.0.0-rc1 至 3.0.1 版本中， 插件通过命令行参数 或 ，或通过包含 条目的 文件，将传入的主机数量存储在一个无符号短整型（unsigned short）变量中。当主机数量超过 65,535 时，计数器会发生回绕（wrap），导致 函数分配了一个过小的主机数组，随后在 函数调用 之前，将后续条目写入数组边界之外。在 被配置为 setuid root 的安装环境中，本地低权限攻击者可以在该进程仍拥有 root 权限时破坏堆内存；

CVSS 7.0 · High

Possible ATT&CK Techniques 1 AI

T1068.001

Affected Version Matrix 1

VendorProduct Version RangeStatus
monitoring-plugins monitoring-plugins >= 3.0.0-rc1, < 3.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63418

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary
Source: CVE Program / CVE List V5
Vulnerability Description
Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
monitoring-plugins monitoring-plugins >= 3.0.0-rc1, < 3.0.1 -

II. Public POCs for CVE-2026-63418

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63418

请登录查看更多情报信息。

Other References for CVE-2026-63418 (3)

IV. Related Vulnerabilities

Same product: monitoring-plugins
Same weakness: CWE-190