CVE-2026-4892: High severity Dnsmasq Dnsmasq vulnerability
A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.
Other sources
In helper.c:265, the DHCPv6 CLID is hex-encoded via sprintf("%.2x") into daemon->packet (5,131 bytes) with no length cap on the CLID. DHCPv6 CLIDs can be up to 65,535 bytes (131,070 hex characters). The helper process retains root privileges. log6packet() already caps CLID to 100 bytes for logging, but the helper code path was missed. Fix: add && i < 100 bound to the encoding loop, matching the logging cap.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.90-4~deb12u2Fixed in 2.91-1+deb13u1Fixed in 2.92-5 - Configuration
In helper.c (around line 265), update the DHCPv6 CLID hex-encoding loop to add a length cap by adding `&& i < 100` to the loop condition so encoding into `daemon->packet` (5,131 bytes) is bounded, matching the existing `log6_packet()` CLID cap of 100 bytes for logging. This mitigates CVE-2026-4892 heap-based out-of-bounds write that can allow arbitrary code execution as root.
dnsmasq DHCPv6 helper (helper.c) CLID hex-encoding loop bound = add && i < 100 bound to the encoding loop
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4892?
CVE-2026-4892 is classified as a high-severity vulnerability due to its potential to allow local attackers to execute arbitrary code with root privileges.
How do I fix CVE-2026-4892?
To remediate CVE-2026-4892, update the dnsmasq package to version 2.90-4~deb12u2 or later, including 2.91-1+deb13u1 or 2.92-5.
What software is affected by CVE-2026-4892?
CVE-2026-4892 affects the dnsmasq software, specifically versions prior to 2.90-4~deb12u2, 2.91-1+deb13u1, and 2.92-5.
Can CVE-2026-4892 be exploited remotely?
CVE-2026-4892 requires local access to exploit, as it relies on sending a crafted DHCPv6 packet.
What type of vulnerability is CVE-2026-4892?
CVE-2026-4892 is a heap-based out-of-bounds write vulnerability found in the DHCPv6 implementation of dnsmasq.