CVE-2026-5172
High · 7.3CVSS
7.3
EPSS
0.7%
Published
May 11, 2026
CISA due date
—
The record
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | dnsmasq | 0 | 2.92rel2-1.1 |
Related vulnerabilities
- CVE-2026-12969 An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in… Also affects dnsmasq
- CVE-2026-12725 A heap-based buffer overflow was found in dnsmasq. Also affects dnsmasq
- CVE-2026-4892 A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq… Also affects dnsmasq
- CVE-2026-4890 A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote… Also affects dnsmasq
- CVE-2026-4891 A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows… Also affects dnsmasq
- CVE-2026-4893 An information disclosure vulnerability in dnsmasq allows remote attackers to bypass… Also affects dnsmasq
- CVE-2026-2291 dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing… Also affects dnsmasq
- CVE-2026-6507 A flaw was found in dnsmasq. Also affects dnsmasq