CVE-2026-14461

MediumCVSS 5.1

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

In mtr (My Traceroute) version 0.96 and earlier, an out-of-bounds read vulnerability exists in the ipinfo_lookup() function. An attacker can trigger a crash by returning a DNS response larger than 512 bytes with a crafted compression pointer in the answer NAME field.

Risk Assessment

The risk is a remote crash of the mtr tool, which can disrupt network diagnostics and potentially be used in DoS attacks against systems using mtr for route monitoring.

Recommendation

Immediately update mtr to a version containing the fix (commit 48e1794414d338ce47abc0f27c25ade8788af9c3) or later. If updating is not possible, restrict mtr usage in environments where DNS responses can be controlled by an attacker.

Other vulnerabilities in mtr

CVE-2000-0172High
The mtr program only uses a seteuid call when attempting to drop privileges, which could allow local users to gain root privileges.

Original NVD description (English source)

mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfo_lookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash. This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.