CVE-2026-12969

Katalog CVE

CVSS 5.3 · Medium EPSS 0,24%

Kerentanan Out-of-bounds Read pada redhat enterprise linux, thekelleys dnsmasq. Skor CVSS 3.1 5.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-12969 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2491663 issue tracking · advisory vendor