libtins CVE-2026-112273

Exploitation requires that the target application built on libtins (through 4.6) actually parses attacker-influenced DNS packets - i.e., the DNS record-parsing path reaching DNS::compose_name must be exercised on additional, answer, or authority records. The specific trigger is a DNS label whose encoding ends exactly at the packet buffer boundary, causing a one-byte read past the buffer. Limiting factors: impact is bounded to a crash (DoS) and is most reliably triggered on hardened/guarded allocators; applications using non-hardened allocators may read adjacent heap memory without crashing. No authentication or user interaction is required (PR:N/UI:N), but the attacker must be able to deliver or inject the malicious DNS packet into the application's parsing pipeline.

This is a moderate-severity, low-real-priority issue despite a network-reachable attack surface. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity reachability, but the impact metrics are narrow: VC:N/VI:N/VA:L - no confidentiality or integrity impact and only LOW availability impact, consistent with a one-byte heap out-of-bounds READ (CWE-125) that crashes applications on hardened allocators rather than leaking meaningful data or enabling code execution. The 'Information Disclosure' tag overstates the confidentiality consequence: the authoritative CVSS vector sets VC:N, so the realistic outcome is a denial-of-service crash, not data exfiltration - verify intended impact with VulnCheck/the researcher. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC flag was supplied in the structured data; a public hackmd write-up describing the parsing bug is referenced, which raises the likelihood that reproduction details are public, but that is an analysis write-up, not a confirmed weaponized exploit. No SSVC decision data was provided. Net: a genuine but low-impact DoS primitive in a non-ubiquitous library, appropriate for routine patching rather than emergency response.

An attacker who can get a vulnerable application (e.g., a packet analyzer, IDS, or network tool built on libtins) to parse attacker-supplied DNS traffic sends a crafted DNS packet whose additional, answer, or authority record contains a label ending exactly at the packet boundary. When DNS::compose_name parses this, it reads one byte past the packet buffer, crashing the process on hardened allocators (denial of service). A public hackmd write-up documents the parsing flaw, but no confirmed weaponized exploit was provided in the input data.