dnsmasq CVE-2026-93009

Requires the target to be running dnsmasq in DHCPv6 server mode so that it parses client-supplied FQDN options; the attacker must sit on the same local link / adjacent network (AV:A) but needs no authentication, no user interaction, and only a single packet (PR:N/UI:N/AC:L). Effect is sharply constrained: the description states the over-read byte is never returned to the client nor logged and that no crash has been demonstrated, so there is no confirmed information disclosure or denial-of-service outcome and no confirmed path to escalate the one-byte read.

Real-world risk is low despite the issue being a genuine memory-safety defect. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N: exploitation is unauthenticated and needs no user interaction, but the Adjacent (AV:A) vector confines the attacker to the same local link, which is a significant practical limiter. The only claimed impact is C:L, and even that is weak - the description explicitly states the over-read byte is neither returned to the client nor logged and that no crash has been demonstrated, so no confidentiality disclosure or availability loss has actually been shown. On the supporting signals: there is no EPSS score in the input, the CVE is not in CISA KEV (not actively exploited), and no PoC or exploit reference is provided, so this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' i.e. routine prioritization rather than act_now/emergency. Net: this is a low-real-risk, high-visibility-vendor (Red Hat) issue rather than an urgent threat - the signals are internally consistent in pointing to low urgency, and the one tension worth noting is that the input's C:L may overstate impact given the description says nothing is disclosed.

An attacker on the same local link as a host running dnsmasq in DHCPv6 server mode sends a single crafted DHCPv6 packet whose FQDN option is built so a label-length check runs before the parser confirms the pointer is still inside the option, causing a one-byte read past the option boundary. Per the available description the over-read byte is not returned to the client nor logged and no crash results, so no concrete attacker benefit is demonstrated. No public exploit is identified at time of analysis.