tftp-hpa CVE-2026-106026

Exploitation requires in.tftpd to be running with the remap feature enabled (the tftpd '-m'/mapfile option pointing to a remap ruleset) AND that ruleset must contain at least one 'jump' rule; the attacker then sends a TFTP read or write request whose filename matches that jump rule. This is NOT a default configuration - tftpd deployments launched without a remap mapfile are not affected. Further limiting factors: the impact is confined to crashing the per-request forked child handler rather than taking down the listening daemon, so the practical effect is degraded/aborted individual transfers rather than full service loss; affected versions are tftp-hpa 5.4 up to (but not including) 6.0.

The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.3 (medium) and is internally consistent with the description: network-reachable (AV:N), unauthenticated (PR:N), no user interaction (UI:N), but carrying an explicit Attack Requirement (AT:P) and only a low availability impact (VA:L) with no confidentiality or integrity impact. The AT:P flag is the key signal - it reflects that exploitation is not possible against a stock daemon but only one configured with remap jump rules, which tempers the otherwise alarming 'unauthenticated remote' profile. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified; the status is no public exploit identified at time of analysis. Note a conflict in the metadata: the CVE carries an 'Information Disclosure' tag and is classified CWE-125 (out-of-bounds read), yet the description and the VC:N/VI:N metrics indicate the only realized effect is a crash of the per-request forked handler - this is effectively a limited denial-of-service, not information disclosure, and defenders should not treat it as a data-exposure issue. Net: this is a genuine but modest-priority bug - remote and unauthenticated, but gated behind a non-default feature and limited to crashing a single forked child rather than the whole service.

An attacker who can reach an in.tftpd instance that has been started with the remap feature enabled sends a TFTP read or write request whose filename matches a remap 'jump' rule, triggering an out-of-bounds heap read in rewrite_string() that crashes the forked request handler. No authentication is required, but the attack only works where remap jump rules are configured. No public proof-of-concept is identified in the provided data.