# CVE-2026-5172: dnsmasq heap out-of-bounds read in extract_addresses

Source: https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-5172 · Severity: high · CVSS 7.3 · Published 2026-05-11

A vulnerability in dnsmasq, a widely used tool for providing network services like DNS and DHCP, could allow an attacker to crash the service. By sending a specially crafted DNS response, an attacker can trigger a memory error that causes the software to stop functioning. This results in a denial-of-service condition, preventing users and devices on the network from resolving domain names or accessing the internet.

Technologies: [Pi-hole FTL](https://junglewise.ai/threats/technologies/ftl), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream), [Simon Kelley Dnsmasq](https://junglewise.ai/threats/technologies/dnsmasq). Vendors: [Pi-hole](https://junglewise.ai/threats/vendors/pi-hole), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Simon Kelley](https://junglewise.ai/threats/vendors/simon-kelley).

## Quick answers

**Is CVE-2026-5172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5172 being exploited in the wild.

**How severe is CVE-2026-5172?** High severity, with a CVSS score of 7.3, published 11 May 2026.

**Which products and versions are affected?** Pi-hole FTL < v6.6.2, prior to 6.6.2; Red Hat Enterprise Linux AppStream 10.2; Simon Kelley Dnsmasq versions prior to 2.92rel2.

**Is there a fix for CVE-2026-5172?** A patch was published on 2026-05-11: dnsmasq 2.92rel2 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5172 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5172?** Check whether you run Pi-hole FTL, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds (OOB) read vulnerability exists in dnsmasq within the extract_addresses() function. The flaw is caused by a mismatched Resource Record (RR) data length (rdlen), which allows the extract_name() function to advance the internal pointer beyond the computed end of the record. This results in an underflow of the remaining-bytes calculation, leading to a large OOB read and a subsequent process crash. The attack can be triggered by a remote attacker providing a malformed DNS response. The issue is addressed in dnsmasq version 2.92rel2 and Pi-hole FTL v6.6.2.

## Affected products

- dnsmasq dnsmasq < 2.92rel2
- Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Pi-hole FTL < v6.6.2

## Timeline

- 2026-05-11: disclosed: Coordinated disclosure by CERT/CC and Simon Kelley
- 2026-05-11: patched: dnsmasq 2.92rel2 released with fixes
- 2026-05-11: advisory: NVD record published

## References

- [https://github.com/NixOS/nixpkgs/pull/519082](https://github.com/NixOS/nixpkgs/pull/519082)
- [https://github.com/NixOS/nixpkgs/pull/519093](https://github.com/NixOS/nixpkgs/pull/519093)
- [https://github.com/pi-hole/FTL/releases/tag/v6.6.2](https://github.com/pi-hole/FTL/releases/tag/v6.6.2)
- [https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html)
- [https://thekelleys.org.uk/dnsmasq/CVE/](https://thekelleys.org.uk/dnsmasq/CVE/)
- [https://www.kb.cert.org/vuls/id/471747](https://www.kb.cert.org/vuls/id/471747)
- [https://access.redhat.com/errata/RHSA-2026:19158](https://access.redhat.com/errata/RHSA-2026:19158)

## Related threats

- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)
- [Red Hat PCP privilege escalation in linux_sockets PMDA](https://junglewise.ai/threats/cve-2026-16526-red-hat-pcp-privilege-escalation-in-linux-sockets-pmda)