Is CVE-2026-12969 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12969 being exploited in the wild.

How severe is CVE-2026-12969?

Medium severity, with a CVSS score of 5.3, published 23 June 2026.

Which products and versions are affected?

thekelleys.org.uk dnsmasq versions before 2.93rc1; Red Hat Red Hat Enterprise Linux 10 affected.

Is there a fix for CVE-2026-12969?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12969 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12969?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12969: dnsmasq out-of-bounds read in find_soa function

CVE-2026-12969 · Severity: medium · CVSS 5.3 · Published 2026-06-23

Dnsmasq is a widely used tool that provides network infrastructure services like DNS and DHCP to local networks. A flaw in how it handles certain DNS responses could allow a remote attacker to read small amounts of sensitive data from the server's memory. While this is unlikely to cause a system crash, it could potentially expose information from previous network transactions.

Quick answers

Is CVE-2026-12969 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12969 being exploited in the wild.
How severe is CVE-2026-12969?: Medium severity, with a CVSS score of 5.3, published 23 June 2026.
Which products and versions are affected?: thekelleys.org.uk dnsmasq versions before 2.93rc1; Red Hat Red Hat Enterprise Linux 10 affected.
Is there a fix for CVE-2026-12969?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12969 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12969?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read exists in dnsmasq's find_soa() function within src/rfc1035.c. When parsing NS section records in NXDOMAIN or NODATA responses, the extract_name() function is called with extrabytes set to 0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields (type, class, TTL, and rdlen). A remote attacker controlling a DNS zone can exploit this by providing a crafted response where the record name extends to the packet boundary, causing GETSHORT/GETLONG macros to read 10 bytes past the valid packet buffer. This can result in the disclosure of stale data from prior DNS transactions. The issue is fixed in dnsmasq version 2.93rc1.

Affected products

thekelleys.org.uk dnsmasq versions before 2.93rc1
Red Hat Red Hat Enterprise Linux 10 affected

Timeline

2026-06-23: disclosed
2026-06-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.