dnsmasq EUVD-2026-38449

The victim host must run dnsmasq as a DNS forwarder or recursive resolver and must issue a query for a domain name for which the attacker serves as the authoritative name server (or can inject a spoofed DNS response). The vulnerability is triggered specifically during processing of NXDOMAIN responses that include NS records in the authority section. Exploitation is limited by the requirement that the attacker either control an authoritative DNS zone queried by the target, or be positioned on-path to intercept and forge DNS UDP responses (e.g., same network segment or via DNS cache poisoning). There is no requirement for authentication to the victim system, but the attacker must induce the victim's dnsmasq instance to query a name under attacker control. Exploitation does not apply if dnsmasq is configured with --port=0 (DNS disabled) or if upstream resolvers are restricted exclusively to trusted servers that validate and sanitize DNS responses before forwarding.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the limited impact: only a 10-byte heap read with no write primitive and no availability impact. The network attack vector and absence of required privileges lower the exploitation barrier significantly, but real-world impact is constrained to information disclosure of stale heap data - contents are non-deterministic and depend on prior heap allocations. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. KEV status is absent and no POC is identified, indicating this is not currently a priority for emergency patching. The primary real-world concern is whether leaked heap bytes could include sensitive data from prior DNS transactions (e.g., partial query content, resolved addresses), which represents a low but non-zero data exposure risk. SSVC signals: exploitation status is none, the vulnerability is not automatable in a way that yields meaningful impact at scale, and technical impact is partial - this rates as a lower-priority remediation item absent evidence of active exploitation.

An attacker registers or compromises an authoritative DNS zone and waits for a target host running dnsmasq to query a name within that zone. The attacker's DNS server responds with a crafted NXDOMAIN message whose NS section contains a resource record with the domain name positioned such that the 10-byte fixed-length trailer falls outside the message buffer boundary. When dnsmasq's find_soa() processes this response, extract_name() reads 10 bytes past the validated buffer, returning stale heap contents that may include fragments of prior DNS transaction data. No public POC has been identified, meaning successful exploitation requires independent development of the crafted DNS packet.