---
id: "CVE-2026-63418"
kind: "vulnerability"
aliases: ["CVE-2026-63418"]
title: "Monitoring Plugins: check_icmp heap overflow can escalate local privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "monitoring-plugins", "nagios", "package", "self-hosted"]
not_affected_if: ["cap-net-raw-instead-of-setuid", "version-3.0.1-or-later", "version-below-3.0.0-rc1"]
published_at: "2026-11-03T18:18:03+00:00"
first_seen_at: "2026-11-03T18:22:10+00:00"
updated_at: "2026-11-03T18:22:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63418", "first_seen_at": "2026-11-03T18:22:10+00:00"}]
---

# Monitoring Plugins: check_icmp heap overflow can escalate local privileges

Monitoring Plugins' check_icmp stores its host count in an unsigned short, so more than 65,535 hosts wrap the counter and cause out-of-bounds writes. On setuid-root installs a local low-privileged user can corrupt heap memory while still running as root, though reliable escalation has not been demonstrated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `check_icmp --version` or look at the installed Monitoring Plugins version.
- Check whether the binary is setuid root with `ls -l $(which check_icmp)`.
- Check whether file capabilities are used instead with `getcap $(which check_icmp)`.

## Fix

- Monitoring Plugins `3.0.1`

## Timeline

- 2026-11-03T18:22:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63418

## Documents

- [advisory] Vendor advisory: github.com https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q
- [fix] Patch: github.com https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a
- [fix] Release notes: github.com https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1

## From the sources

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_