libtins CVE-2026-112274

The target application must be built on libtins through 4.6 AND use the DNS buffer constructor to parse attacker-controlled SOA resource records; the attacker must supply raw SOA RDATA that lacks a terminating zero byte so that strlen runs past the buffer. Limiting factors: exploitation only reaches vulnerable code in applications that actually parse untrusted/network-sourced DNS SOA data via this constructor (not all libtins consumers do), and reliable crashing depends on heap layout and the absence of a nearby NUL byte (reflected as AC:H/AT:P). No authentication or user interaction is required (PR:N/UI:N), but the specific unterminated-SOA parsing path is the hard prerequisite.

This is a medium-severity (CVSS 6.3) issue whose real-world urgency is lower than the raw score suggests. Positive-for-attacker signals are AV:N, PR:N and UI:N - a remote, unauthenticated attacker needs no privileges or victim interaction. These are counterbalanced by AC:H plus AT:P (CVSS 4.0), meaning reliable triggering depends on specific attack requirements and heap layout, not a one-shot deterministic exploit. No CISA KEV listing and no EPSS score were provided, so there is no evidence of active or at-scale exploitation and no way to quantify exploitation probability from the input; absence of these signals plus the specialized affected product points to low practical urgency. Demonstrated impact is limited: the vendor CVSS 4.0 vector scores VC:N/VI:N/VA:L (availability-only crash), yet the input Tags and the CWE-125 over-read nature imply potential confidentiality/information disclosure - this is a genuine conflict (Information Disclosure tag vs VC:N). The over-read is consumed internally by strlen, so a crash (DoS) is the confirmed outcome while adjacent-heap disclosure is plausible but unconfirmed. Bottom line: a real but not emergency priority - patch if you run libtins through 4.6 and parse untrusted DNS SOA records, otherwise schedule normally.

An attacker operating or spoofing a DNS server returns a crafted SOA resource record whose RDATA omits the trailing NUL/zero byte to an application built on libtins (≤4.6) that parses the response via the DNS buffer constructor. When soa_record::init calls strlen on the unterminated field, it reads past the heap buffer, crashing the consuming application (denial of service) and potentially incorporating adjacent heap bytes into the parsed name. A public technical write-up describes the flaw, but no weaponized exploit code is confirmed, and reliable crashing depends on heap layout (AC:H/AT:P).