Junglewise Threat Intelligence

CVE-2026-5172: dnsmasq heap out-of-bounds read in extract_addresses

CVE-2026-5172 · Severity: high · CVSS 7.3 · Published 2026-05-11

Executive brief

A vulnerability in dnsmasq, a widely used tool for providing network services like DNS and DHCP, could allow an attacker to crash the service. By sending a specially crafted DNS response, an attacker can trigger a memory error that causes the software to stop functioning. This results in a denial-of-service condition, preventing users and devices on the network from resolving domain names or accessing the internet.

Technical details

A heap out-of-bounds (OOB) read vulnerability exists in dnsmasq within the extract_addresses() function. The flaw is caused by a mismatched Resource Record (RR) data length (rdlen), which allows the extract_name() function to advance the internal pointer beyond the computed end of the record. This results in an underflow of the remaining-bytes calculation, leading to a large OOB read and a subsequent process crash. The attack can be triggered by a remote attacker providing a malformed DNS response. The issue is addressed in dnsmasq version 2.92rel2 and Pi-hole FTL v6.6.2.

Affected products

  • dnsmasq dnsmasq < 2.92rel2
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Pi-hole FTL < v6.6.2

Timeline

  • 2026-05-11: disclosed: Coordinated disclosure by CERT/CC and Simon Kelley
  • 2026-05-11: patched: dnsmasq 2.92rel2 released with fixes
  • 2026-05-11: advisory: NVD record published

References

Related threats