dnsmasq EUVD-2026-112825

Exploitation requires two specific preconditions: (1) the dnsmasq DHCP leasequery feature must be explicitly enabled by an administrator - it is off by default - and (2) it must be configured without a list of allowed source addresses, so the server performs no check on who sent the query. The attacker must also be positioned on the same local/adjacent network as the server (AV:A), limiting exploitation to on-link hosts rather than arbitrary remote attackers. No authentication or user interaction is needed once those conditions hold (PR:N/UI:N). Impact is confined to disclosure of DHCP lease metadata (assigned IPs, MAC addresses, hostnames, lease details); there is no integrity or availability impact. The off-by-default, non-standard-configuration requirement is the primary factor limiting real-world exposure.

All available signals point to a genuinely low-to-moderate real-world risk rather than an urgent priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes an unauthenticated, low-complexity attack but one bounded to the adjacent/local network (AV:A, not AV:N) with only low confidentiality impact and no integrity or availability impact (C:L/I:N/A:N) - consistent with the information-disclosure nature of CWE-862 (Missing Authorization). The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with a non-critical, patch-in-routine-cycle posture. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was supplied in the input, so exploitation probability cannot be quantified here; and no proof-of-concept or exploit reference appears among the references (only the Red Hat advisory and Bugzilla entry), so there is no public exploit identified at time of analysis. The single most important mitigating factor is that the vulnerable behavior exists only when an administrator has explicitly enabled DHCP leasequery without listing allowed source addresses - the feature is off by default - so the exposed population is far smaller than the CPE list of Red Hat products suggests. Net assessment: a real but minor issue, appropriately rated medium, that leaks lease metadata to an on-link attacker under a non-default configuration; not a high-urgency item.

An attacker with a foothold on the same local network segment as a dnsmasq server that has DHCP leasequery enabled without an allowed-source-address list sends a leasequery request to the server. Because the server does not verify who sent the query, it returns lease records, and the attacker harvests assigned IP addresses, MAC addresses, hostnames, and related lease metadata for network reconnaissance. No public exploit was identified at time of analysis, and the adjacent-network attack vector means the attacker must already be on the local link.