CVE-2026-106026: tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule
tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewritestring() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running tftp-hpa versions 5.4 before 6.0 are exposed when their tftpd remap configuration includes a jump rule that can match an attacker-supplied filename.
What does an attacker need to exploit the vulnerability?
An unauthenticated remote attacker needs network access to the TFTP service and must send a read or write request with a filename that matches a remap jump rule. No user interaction or prior privileges are required.
What is the practical impact of exploitation?
Exploitation can crash the forked in.tftpd handler processing the request, resulting in denial of service for that request handler. The provided information does not indicate confidentiality or integrity impact.
How can I determine whether my deployment is affected?
Verify whether the installed tftp-hpa version is 5.4 or later but earlier than 6.0, then inspect the tftpd remap rules for jump rules that could match filenames supplied in TFTP read or write requests.