CVE-2026-5172: Buffer Overflow
A buffer overflow in dnsmasq’s extractaddresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extractname() to advance the pointer past the record’s end.
Other sources
In extractaddresses() at rfc1035.c:943, the rdlen field of an RR is trusted without verification. When extractname() is called on the record's data, it can advance p1 past the calculated end of the record (endrr). The subsequent calculation of remaining bytes (endrr - p1) underflows to a huge unsigned value, causing a massive heap OOB read and certain crash. Fix: add p1 > endrr check after the extractname() call.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.90-4~deb12u2Fixed in 2.91-1+deb13u1Fixed in 2.92-5 - Configuration
In extract_addresses() at rfc1035.c:943, after the extract_name() call, add a check that p1 > endrr is handled (i.e., verify the pointer does not advance past the end of the RR) to prevent heap out-of-bounds reads/crash from malformed DNS responses. CVE-2026-5172.
dnsmasq (rfc1035.c extract_addresses) p1 > endrr check after extract_name() call = Add conditional check: if (p1 > endrr) then treat record as invalid/abort parsing
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5172?
CVE-2026-5172 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2026-5172?
To remediate CVE-2026-5172, update dnsmasq to the fixed versions 2.90-4~deb12u2, 2.91-1+deb13u1, or 2.92-5.
What versions of dnsmasq are affected by CVE-2026-5172?
CVE-2026-5172 affects dnsmasq versions up to and including 2.85-1, 2.90-4~deb12u1, and 2.91-1.
Can CVE-2026-5172 cause system crashes?
Yes, CVE-2026-5172 can trigger a heap out-of-bounds read that leads to system crashes.
What software is impacted by CVE-2026-5172?
CVE-2026-5172 impacts the dnsmasq software used in various network configurations.