CVE-2026-12969

The record

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

Affected packages

Related vulnerabilities

• CVE-2026-12725 A heap-based buffer overflow was found in dnsmasq. Also affects dnsmasq
• CVE-2026-4892 A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq… Also affects dnsmasq
• CVE-2026-4890 A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote… Also affects dnsmasq
• CVE-2026-4891 A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows… Also affects dnsmasq
• CVE-2026-4893 An information disclosure vulnerability in dnsmasq allows remote attackers to bypass… Also affects dnsmasq
• CVE-2026-5172 A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger… Also affects dnsmasq
• CVE-2026-2291 dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing… Also affects dnsmasq
• CVE-2026-6507 A flaw was found in dnsmasq. Also affects dnsmasq