Is CVE-2026-4892 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4892 being exploited in the wild.

How severe is CVE-2026-4892?

High severity, with a CVSS score of 8.4, published 11 May 2026.

Is there a fix for CVE-2026-4892?

A patch was published on 2026-05-11: Fixed in dnsmasq 2.92rel2 and Pi-hole FTL v6.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4892 attacked?

It is attacked from the adjacent network or with local access, in a software library.

Am I affected by CVE-2026-4892?

Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4892: dnsmasq heap overflow in DHCPv6 helper

CVE-2026-4892 · Severity: high · CVSS 8.4 · Published 2026-05-11

A security vulnerability exists in dnsmasq, a widely used tool for providing network services like DNS and DHCP to local networks. An attacker on the same network can send a specially crafted request that causes the software to crash or allows them to take full control of the underlying system with administrative privileges. This could lead to a complete compromise of the device, potentially affecting network traffic routing and security for all connected users.

Technologies: Pi-hole FTL. Vendors: Pi-hole.

Quick answers

Is CVE-2026-4892 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4892 being exploited in the wild.
How severe is CVE-2026-4892?: High severity, with a CVSS score of 8.4, published 11 May 2026.
Which products and versions are affected?: Pi-hole FTL < 6.6.2.
Is there a fix for CVE-2026-4892?: A patch was published on 2026-05-11: Fixed in dnsmasq 2.92rel2 and Pi-hole FTL v6.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4892 attacked?: It is attacked from the adjacent network or with local access, in a software library.
Am I affected by CVE-2026-4892?: Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the DHCPv6 implementation of dnsmasq, specifically within the DHCP helper component. When the '--dhcp-script' configuration is enabled, the software fails to properly validate the length of hex-encoded DHCPv6 client identifiers. While these identifiers can be up to 65,535 bytes, they are written into a fixed 5,131-byte buffer in a process running with root privileges. An attacker on the local network or adjacent segment can exploit this by sending a crafted DHCPv6 packet to trigger an out-of-bounds write, leading to remote code execution as root. The vulnerability is addressed in dnsmasq version 2.92rel2 and Pi-hole FTL v6.6.2.

Affected products

dnsmasq dnsmasq < 2.92rel2
Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10
Red Hat OpenShift Container Platform 4
Pi-hole FTL < 6.6.2

Timeline

2026-05-11: disclosed
2026-05-11: patched: Fixed in dnsmasq 2.92rel2 and Pi-hole FTL v6.6.2
2026-05-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.