---
id: CVE-2026-63418
title: >-
  Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root
  binary
summary: >-
  Monitoring Plugins is a suite of plugins for monitoring applications. From
  3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through
  -H or --Host on the command line, or through --extra-opts files containing
  Host= ent…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-190
  - CWE-787
vendor: monitoring-plugins
product: monitoring-plugins
affected:
  - 'monitoring-plugins >= 3.0.0-rc1, < 3.0.1'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T22:36:36.088082Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:40:52.744Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63418'
references:
  - url: >-
      https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q
    label: >-
      https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q
  - url: >-
      https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a
    label: >-
      https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a
  - url: >-
      https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1
    label: >-
      https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.03285
ingestedAt: '2026-11-05T20:33:06.603Z'
---

## Overview

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

## Affected

- `monitoring-plugins >= 3.0.0-rc1, < 3.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.