Skip to main content

dnsmasq EUVDEUVD-2026-29154

| CVE-2026-4892 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-05-11 certcc GHSA-m62j-63mf-xr95
RCE Buffer Overflow Heap Overflow Dnsmasq
8.4
CVSS 3.1 · Vendor: certcc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local network access
  2. Delivery
    Send crafted DHCPv6 packet
  3. Exploit
    Trigger heap overflow in parser
  4. Execution
    Overwrite heap metadata/pointers
  5. Persist
    Hijack execution flow
  6. Impact
    Execute payload as root

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires dnsmasq configured to provide DHCPv6 services (--enable-ra or --dhcp-range with IPv6 addresses enabled in config). Attacker must be positioned on the local network segment where dnsmasq listens for DHCPv6 traffic (UDP port 547, typically link-local scope). Does NOT require authentication (PR:N) to send DHCPv6 packets - standard IPv6 network clients send these during address autoconfiguration. Does NOT require user interaction (UI:N). Local attack vector (AV:L) limits exploitation to attackers with local network access, which in many environments means compromised client devices, rogue devices on corporate LANs, or malicious insiders. Default dnsmasq installations with DHCPv6 disabled (DHCPv4-only mode) are NOT vulnerable - exploitation depends on explicit DHCPv6 feature enablement. Environments using stateless IPv6 autoconfiguration (SLAAC) without dnsmasq DHCPv6 are also not affected.
Impact

CVSS 8.4 (AV:L/AC:L/PR:N/UI:N) indicates local attack vector with low complexity and no privileges required - unusual combination requiring clarification. Local vector (AV:L) typically limits impact to systems where attacker already has local access, yet PR:N suggests no authentication, which contradicts local-only exploitation. This discrepancy needs vendor verification: description states 'local attackers' but does not specify whether local network access (sending DHCPv6 packets to local subnet) or local system access (shell on target) is required. CERT/CC involvement (VU#471747) and vendor-specific advisory page suggest coordinated disclosure with real impact. No CISA KEV listing indicates no confirmed widespread exploitation. No public POC identified, reducing immediate mass-exploitation risk. However, dnsmasq's ubiquity in network infrastructure (routers, IoT, Linux servers) makes this a supply-chain concern. NixOS patching to 2.92rel2 within days suggests Linux distributions treat this seriously. Real-world risk depends on DHCPv6 deployment: many environments use DHCPv4 only or static IPv6 configs, limiting attack surface. Exploitability is high (AC:L) once attacker can deliver crafted packets, but scope is unchanged (S:U), containing impact to dnsmasq process. Priority: HIGH for systems with DHCPv6 enabled and dnsmasq exposed to untrusted local networks; MEDIUM for DHCPv4-only or IPv6-disabled environments.
Exploit ScenarioDerived

Attacker on the same local network segment as a dnsmasq DHCPv6 server crafts a malicious DHCPv6 SOLICIT or REQUEST packet with oversized option fields. When dnsmasq parses the packet, insufficient bounds checking causes heap buffer overflow, overwriting adjacent heap metadata or function pointers. Attacker leverages overflow to redirect execution flow, injecting shellcode that spawns a root shell or installs persistent backdoor, since dnsmasq typically runs with root privileges for port binding and system configuration. No public POC identified, but exploit development is straightforward given low complexity (AC:L) once packet format is reversed.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 11, 2026

Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with root privileges. Affects dnsmasq 2.93 (and potentially earlier 2.92 branch based on NixOS patching activity). CERT/CC issued VU#471747, and upstream published CVE-specific advisory at thekelleys.org.uk/dnsmasq/CVE/. NixOS patch activity (PR #519082, #519093) indicates real-world remediation effort. No CISA KEV listing or public POC identified at time of analysis, suggesting limited active exploitation despite high CVSS 8.4 score.

RemediationAI

Upgrade to dnsmasq 2.92rel2 or later, confirmed by NixOS packaging changes in GitHub PR #519082 and #519093 (https://github.com/NixOS/nixpkgs/pull/519082). Official vendor guidance expected at https://thekelleys.org.uk/dnsmasq/CVE/. For distributions, monitor vendor security advisories: NixOS already patched, Debian/Ubuntu/RHEL advisories pending. If immediate patching is not feasible and DHCPv6 is not required, disable DHCPv6 functionality via dnsmasq configuration (remove --enable-ra or --dhcp-range IPv6 directives, restart service) - side effect: breaks IPv6 address autoconfiguration for clients, acceptable if IPv4-only or static IPv6 used. If DHCPv6 required, restrict dnsmasq network exposure using firewall rules to accept UDP 547 only from trusted management networks, not general client VLANs - this limits local attack surface but does not eliminate risk from compromised trusted hosts. Verify patch application by checking dnsmasq version (dnsmasq --version) and reviewing https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html for upstream confirmation.

Affected VersionsENISA

dnsmasq 2.93

Affected Packages

euvd dnsmasq no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

dnsmasq is a lightweight DNS forwarder and DHCP/DHCPv6 server commonly deployed in Linux distributions, routers, and embedded systems. The vulnerability resides in DHCPv6 packet parsing logic (CWE unspecified, but classic heap buffer overflow). CPE string cpe:2.3:a:dnsmasq:dnsmasq:*:*:*:*:*:*:*:* indicates broad applicability across dnsmasq installations. DHCPv6 operates over UDP port 547, handling IPv6 address allocation and network configuration. Heap-based out-of-bounds writes typically occur when packet length fields are not validated before copying data into fixed-size heap buffers, allowing attacker-controlled data beyond allocated memory. In privileged network services like dnsmasq (often runs as root for low-port binding), memory corruption directly yields root code execution.

Know when Dnsmasq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (certcc) PRIMARY 8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
May 11, 2026 - 19:22 NVD
8.4 (HIGH)
CVE Published
May 11, 2026 - 16:47 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 16:47 nvd
HIGH 8.4

DescriptionCVE.org

A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.

Executive ViewAI

Why It Matters

CVE-2026-4892 is a high-severity heap-based buffer overflow in dnsmasq's DHCPv6 implementation affecting version 2.93 and potentially 2.92, allowing local attackers to execute arbitrary code with root privileges. Organizations running dnsmasq as a network service face direct risk to infrastructure integrity, as compromised instances could be leveraged for lateral movement or persistent access within the network. Immediate vulnerability assessment and mitigation planning are required given the absence of an available vendor patch.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable DHCPv6 service if operationally feasible; (2) restrict local user access to dnsmasq via system-level access controls (AppArmor, SELinux, or chroot isolation); (3) monitor dnsmasq process for unexpected privilege escalation or memory corruption signals; (4) evaluate community-contributed patches from NixOS or similar distributions pending official vendor release; (5) isolate affected dnsmasq instances on dedicated network segments with egress monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Dnsmasq

View all
CVE-2017-14492 CRITICAL POC
9.8 Oct 03

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-13704 HIGH
7.5 Oct 03

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call get
CVE-2017-14495 HIGH POC
7.5 Oct 03

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote

CVE-2017-14496 HIGH POC
7.5 Oct 03

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
CVE-2017-14493 CRITICAL POC
9.8 Oct 03

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
CVE-2026-116233 HIGH POC
8.5 Oct 26

CRLF injection in the Dnsmasq configuration path of Oray Pugongying X5 Pro 7.6.1 lets a user who already holds administr
CVE-2017-14494 MEDIUM POC
5.9 Oct 03

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
CVE-2019-14513 HIGH POC
7.5 Aug 01

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that

CVE-2015-3294 MEDIUM POC
6.4 May 08

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function
CVE-2013-0198 MEDIUM POC
5.0 Mar 05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces,

CVE-2021-3448 MEDIUM POC
4.0 Apr 08

A flaw was found in dnsmasq in versions before 2.85. Rated medium severity (CVSS 4.0), this vulnerability is remotely ex

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4892 ADVISORY https://ubuntu.com/security/notices/USN-8268-1 ADVISORY https://vuldb.com/vuln/362748 REF https://access.redhat.com/errata/RHSA-2026:19158 REF https://access.redhat.com/errata/RHSA-2026:19373 REF https://access.redhat.com/errata/RHSA-2026:20589 REF https://access.redhat.com/errata/RHSA-2026:34508 REF https://access.redhat.com/errata/RHSA-2026:40762 REF https://access.redhat.com/security/cve/CVE-2026-4892 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458518 REF https://github.com/NixOS/nixpkgs/pull/519082 REF https://github.com/NixOS/nixpkgs/pull/519093 REF https://github.com/pi-hole/FTL/releases/tag/v6.6.2 REF https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4892.json REF https://thekelleys.org.uk/dnsmasq/ REF https://thekelleys.org.uk/dnsmasq/CVE/ REF https://www.kb.cert.org/vuls/id/471747

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy