Executive brief
mtr is a popular network diagnostic tool used to analyze the path and performance of internet connections. A vulnerability in how the tool handles network information lookups allows a malicious actor to crash the application. This occurs when the tool receives a specially crafted response from a DNS server, potentially disrupting network troubleshooting activities.
Technical details
An out-of-bounds read vulnerability exists in the ipinfo_lookup() function within ui/asn.c of mtr. The flaw is triggered when the application processes a DNS TXT response used for Autonomous System (AS) lookups that exceeds 512 bytes and contains a crafted compression pointer in the answer NAME field. The root cause is that the function uses the raw length of the response as the end-of-message boundary for the dn_expand() function without proper validation. An attacker controlling a DNS response can cause a denial-of-service (crash). The issue is fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3 by clipping the length to PACKETSZ.
Affected products
- BitWizard mtr All versions through 0.96
Timeline
- 2026-07-10: advisory: Advisory published by CERT Polska and NVD
- 2026-07-10: patched: Fix committed to mtr repository