CVE-2026-93009: Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
Other sources
A one-byte heap out-of-bounds read was found in dnsmasq's DHCPv6 OPTIONCLIENTFQDN (option 39) decoder in src/rfc3315.c. The label-parsing loop evaluates while (op != 0 && bounds), dereferencing op before checking that op is still within the option data. If labels exactly fill the option payload with no trailing NUL, op lands one byte past the option and the next iteration reads that byte.
The OOB byte is used only as a loop-termination condition. It is not returned to the client, logged, or stored. No crash or information leak was demonstrated. HAVEDHCP6 is compiled by default. Attack vector is adjacent (DHCPv6 link-local).
Affected versions: v2.61 through HEAD. Introducing commit: fbbc1454 (Fix off-by-one in DHCPv6 FQDN option decoding), which left a residual off-by-one in the termination condition. Unaffected: v2.60 and earlier. Fix: Not yet available (reporter coordinating with upstream). Reporter: Shubham Raj (Causal Security) PSIRT Ticket: PSIRTSUPT-23743
— Red Hat
Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker on the same local network segment who can send DHCPv6 traffic can trigger it with a single crafted DHCPv6 packet. No authentication or user interaction is required.
Are default dnsmasq builds affected?
Yes. The affected DHCPv6 support is controlled by HAVE_DHCP6, which is compiled by default. Versions from v2.61 through HEAD are identified as affected.
What is the practical impact of successful exploitation?
The crafted option causes a one-byte heap out-of-bounds read used only to decide whether the label-parsing loop should continue. The byte is not returned, logged, or stored, and the available information reports no demonstrated crash or information leak.
How can I determine whether an instance is exposed?
An instance is potentially exposed if it runs an affected dnsmasq version with DHCPv6 support and can receive DHCPv6 packets from untrusted or insufficiently trusted devices on its local network. The triggering input is DHCPv6 OPTION_CLIENT_FQDN (option 39) whose labels exactly fill the option payload without a trailing NUL.