EUVD-2025-16897CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
3Description
We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled. Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.
Analysis
Buffer overflow vulnerability (CWE-787: Out-of-bounds Write) in DNS name processing affecting systems running LLMNR or mDNS with Buffer Allocation Scheme 1 enabled. An attacker with local access can trigger out-of-bounds writes by crafting LLMNR/mDNS queries with excessively long DNS names, potentially achieving code execution or system compromise. The vulnerability requires local access (AV:L) but no user interaction or authentication, making it a significant privilege escalation vector on multi-user systems.
Technical Context
This vulnerability exists in the DNS name processing logic for LLMNR (Link-Local Multicast Name Resolution, RFC 4795) and mDNS (Multicast DNS, RFC 6762) implementations. The root cause is improper bounds checking in buffer allocation and write operations (CWE-787: Out-of-bounds Write) when handling DNS domain names that exceed expected length constraints. Systems using 'Buffer Allocation Scheme 1'—a specific memory allocation strategy—are vulnerable due to insufficient validation of DNS name lengths before writing to allocated buffers. The vulnerability is triggered during query processing, suggesting the flaw exists in the DNS packet parsing or name decompression routines. This affects network stack implementations across Windows, Linux, and potentially other operating systems that implement these DNS protocols natively or through third-party libraries.
Affected Products
Based on the CVE description, affected systems are those running: (1) Windows with LLMNR enabled and Buffer Allocation Scheme 1 active; (2) Linux systems (systemd-resolved, avahi-daemon) with mDNS/LLMNR enabled and vulnerable buffer management; (3) BSD systems with native LLMNR/mDNS stacks using the specified allocation scheme; (4) Embedded systems and IoT devices implementing DNS protocols with this allocation pattern. Specific version ranges cannot be determined without vendor advisories. The description indicates a broad issue affecting multiple implementations, suggesting vulnerability may exist across: Windows (any version with LLMNR enabled), glibc DNS implementations, musl libc DNS stacks, and third-party DNS libraries. CPE patterns would likely include: cpe:2.7:a:*:dns:*:*:*:*:*:*:*:* and cpe:2.7:o:microsoft:windows:*:*:*:*:*:*:*:* with LLMNR-specific configurations. Vendors should release patches specifying affected version ranges and Configuration Scheme 1 settings.
Remediation
Immediate actions: (1) Upgrade to the latest patched version of affected software (vendor advisories required for specific version numbers); (2) Verify Buffer Allocation Scheme in use—organizations using Scheme 2 or later are unaffected and can deprioritize patching; (3) Disable LLMNR and mDNS on systems where not required (Windows: Group Policy 'Turn off multicast name resolution', Linux: systemctl disable systemd-resolved/avahi-daemon); (4) Restrict local user account creation on critical systems to reduce privilege escalation vectors; (5) Implement address space layout randomization (ASLR) and control-flow guard protections to complicate exploitation; (6) Monitor for DNS-related crashes or memory protection violations in system logs. Workarounds include network segmentation to limit untrusted local access and disabling DNS services entirely where LAN name resolution is not essential. Derivative code and forked projects must apply patches independently as noted in the advisory.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today