CVE-2026-4890

An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.

A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.

In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.

Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

A flow in the dnssec.c library causes an infinite loop in the dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.