# CVE-2026-4892: dnsmasq heap overflow in DHCPv6 helper

Source: https://junglewise.ai/threats/cve-2026-4892-dnsmasq-heap-overflow-in-dhcpv6-helper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4892 · Severity: high · CVSS 8.4 · Published 2026-05-11

A security vulnerability exists in dnsmasq, a widely used tool for providing network services like DNS and DHCP to local networks. An attacker on the same network can send a specially crafted request that causes the software to crash or allows them to take full control of the underlying system with administrative privileges. This could lead to a complete compromise of the device, potentially affecting network traffic routing and security for all connected users.

Technologies: [Pi-hole FTL](https://junglewise.ai/threats/technologies/ftl). Vendors: [Pi-hole](https://junglewise.ai/threats/vendors/pi-hole).

## Quick answers

**Is CVE-2026-4892 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4892 being exploited in the wild.

**How severe is CVE-2026-4892?** High severity, with a CVSS score of 8.4, published 11 May 2026.

**Which products and versions are affected?** Pi-hole FTL < 6.6.2.

**Is there a fix for CVE-2026-4892?** A patch was published on 2026-05-11: Fixed in dnsmasq 2.92rel2 and Pi-hole FTL v6.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4892 attacked?** It is attacked from the adjacent network or with local access, in a software library.

**Am I affected by CVE-2026-4892?** Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the DHCPv6 implementation of dnsmasq, specifically within the DHCP helper component. When the '--dhcp-script' configuration is enabled, the software fails to properly validate the length of hex-encoded DHCPv6 client identifiers. While these identifiers can be up to 65,535 bytes, they are written into a fixed 5,131-byte buffer in a process running with root privileges. An attacker on the local network or adjacent segment can exploit this by sending a crafted DHCPv6 packet to trigger an out-of-bounds write, leading to remote code execution as root. The vulnerability is addressed in dnsmasq version 2.92rel2 and Pi-hole FTL v6.6.2.

## Affected products

- dnsmasq dnsmasq < 2.92rel2
- Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10
- Red Hat OpenShift Container Platform 4
- Pi-hole FTL < 6.6.2

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: patched: Fixed in dnsmasq 2.92rel2 and Pi-hole FTL v6.6.2
- 2026-05-11: advisory

## References

- [https://github.com/NixOS/nixpkgs/pull/519082](https://github.com/NixOS/nixpkgs/pull/519082)
- [https://github.com/NixOS/nixpkgs/pull/519093](https://github.com/NixOS/nixpkgs/pull/519093)
- [https://github.com/pi-hole/FTL/releases/tag/v6.6.2](https://github.com/pi-hole/FTL/releases/tag/v6.6.2)
- [https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html)
- [https://thekelleys.org.uk/dnsmasq/CVE/](https://thekelleys.org.uk/dnsmasq/CVE/)
- [https://www.kb.cert.org/vuls/id/471747](https://www.kb.cert.org/vuls/id/471747)
- [https://access.redhat.com/errata/RHSA-2026:19158](https://access.redhat.com/errata/RHSA-2026:19158)

## Related threats

- [Pi-hole FTL session hijacking via race condition in HTTP engine](https://junglewise.ai/threats/cve-2026-44693-pi-hole-ftl-session-hijacking-via-race-condition-in-http-engine)
- [Pi-hole local privilege escalation via unvalidated config paths](https://junglewise.ai/threats/cve-2026-41489-pi-hole-local-privilege-escalation-via-unvalidated-config-paths)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)