Junglewise Threat Intelligence

CVE-2026-2291: dnsmasq heap buffer overflow in extract_name

CVE-2026-2291 · Severity: high · CVSS 7.3 · Published 2026-05-11

Executive brief

dnsmasq is a widely used tool for providing network services like DNS and DHCP to small networks and home routers. A vulnerability in how it handles domain names allows an attacker to corrupt the system's memory, which can be used to redirect users to malicious websites or crash the service entirely. This could lead to users unknowingly visiting fraudulent sites or a total loss of internet connectivity for the affected network.

Technical details

A heap-based buffer overflow exists in dnsmasq's extract_name() function within the bigname structure. The vulnerability stems from the on-heap namebuffer being sized for the wire form of a domain name (MAXDNAME) rather than its larger escaped internal form (MAXDNAME*2 + 1). A remote attacker sending or answering DNS queries can trigger a large out-of-bounds write on the heap. This can be exploited to poison the DNS cache, redirecting traffic to attacker-controlled IP addresses, or to cause a service crash (DoS). The issue is fixed in version 2.92rel2 and later.

Affected products

  • dnsmasq dnsmasq < 2.92rel2

Timeline

  • 2026-05-11: disclosed
  • 2026-05-11: patched: Fixed in version 2.92rel2
  • 2026-05-11: advisory

References

Related threats