dnsmasq EUVD-2026-112791

Requires dnsmasq to be running with its TFTP server feature enabled (typically for PXE/network boot) - the flaw does not exist when TFTP is not in use. The attacker must be on the adjacent/local network able to issue TFTP requests to the server (AV:A), and exploitation is unauthenticated (PR:N, TFTP has no auth) with no user interaction (UI:N). Key limiting factors: the attack is high-complexity (AC:H) because the attacker cannot control when a later client will request the same file and thus receive the stale cached data; it is not remotely exploitable over the internet; and meaningful impact (malicious boot content) depends on the environment actually using dnsmasq TFTP for PXE provisioning, a non-default, specific deployment mode.

This is a moderate-severity, situational issue rather than a drop-everything emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 6.8) correctly frames it as adjacent-network (not internet-routable), high-complexity, and unauthenticated, with high confidentiality and integrity impact but no availability impact - matching CWE-672 (use of a resource after expiration/release: the TFTP transfer cache is not invalidated when a transfer completes). The vuln.today decision label is 'this_month', which aligns with a real-but-not-urgent priority. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing, no POC/exploit reference in the input, and no EPSS score provided, so widespread or automated exploitation is not indicated. The main caveat is that the real-world impact hinges entirely on deployment: the flaw matters only where dnsmasq's TFTP server is enabled, typically for PXE network boot, which is a specific (often datacenter/provisioning) configuration rather than a default. Within such environments the integrity consequence - substituting attacker-chosen boot content - is serious, but AC:H reflects that the attacker cannot control when a later client will request the stale-cached file. No conflicting signals were found; the chief gap is the absence of EPSS/KEV/POC data and no listed fixed version in the provided sources.

On a LAN segment served by a dnsmasq instance with its TFTP server enabled for PXE boot, an attacker requests a TFTP file, leaving its contents in the transfer cache that is never invalidated after the transfer finishes. When a victim machine subsequently PXE-boots and requests its boot file, dnsmasq serves the previously cached data instead of the correct file, allowing attacker-chosen boot content to be delivered to the victim. No public exploit code is identified; the adjacent-network vector and high attack complexity (the attacker cannot control the timing of the later client request) limit opportunistic abuse.