Is CVE-2026-12725 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12725 being exploited in the wild.

How severe is CVE-2026-12725?

Medium severity, with a CVSS score of 5.9, published 22 June 2026.

Which products and versions are affected?

thekelleys.org.uk dnsmasq versions prior to 2.92rel2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; and 1 more.

Is there a fix for CVE-2026-12725?

A patch was published on 2026-06-22: Upstream fix identified in version 2.92rel2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12725 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12725?

Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12725: Dnsmasq heap buffer overflow in log_query function

CVE-2026-12725 · Severity: medium · CVSS 5.9 · Published 2026-06-22

Dnsmasq is a widely used tool that provides network infrastructure services like DNS and DHCP to local networks. A flaw was found where the software can crash when it attempts to log specific types of security-related DNS records that it does not recognize. This could allow a remote attacker to disrupt internet connectivity or local network services by causing the dnsmasq process to stop working.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-12725 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12725 being exploited in the wild.
How severe is CVE-2026-12725?: Medium severity, with a CVSS score of 5.9, published 22 June 2026.
Which products and versions are affected?: thekelleys.org.uk dnsmasq versions prior to 2.92rel2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; and 1 more.
Is there a fix for CVE-2026-12725?: A patch was published on 2026-06-22: Upstream fix identified in version 2.92rel2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12725 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12725?: Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the log_query() function within src/cache.c of dnsmasq. When query logging (--log-queries) and DNSSEC validation are both enabled, the software fails to properly bound the length of strings written to the internal 46-byte 'daemon->addrbuff' heap buffer. Specifically, when logging DS or DNSKEY replies containing IANA-unassigned or unsupported algorithm/digest types, the addition of a "(not supported)" suffix via sprintf() causes a write past the buffer end. While the overflow is bounded (approximately 12 bytes) and the content is not directly attacker-controlled, it can lead to heap corruption and process crashes. The issue is fixed in upstream version 2.92rel2 (commit 36d081e).

Affected products

thekelleys.org.uk dnsmasq versions prior to 2.92rel2
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10
Red Hat OpenShift Container Platform 4

Timeline

2026-06-19: disclosed: Initial report in Red Hat Bugzilla
2026-06-22: advisory: NVD publication date
2026-06-22: patched: Upstream fix identified in version 2.92rel2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.