CVE-2026-4892
HighCVSS 8.4Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Heap-based out-of-bounds write in dnsmasq DHCPv6 allows local attackers to execute code as root.
Risk Assessment
A local attacker can gain full root control over the system.
Recommendation
Update dnsmasq to a patched version or restrict DHCPv6 access.
Other vulnerabilities in dnsmasq
See all- CVE-2017-14496High
An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.
- CVE-2017-14495High
A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.
- CVE-2017-13704High
In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.
- CVE-2015-8899High
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
- CVE-2026-4891Medium
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
- CVE-2026-4890High
The DNSSEC validation in dnsmasq has a denial of service (DoS) vulnerability. A remote attacker can send a crafted DNS packet, causing the service to crash.
- CVE-2017-14491Critical
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
- CVE-2017-14493Critical
A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
- CVE-2017-14492Critical
Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
- CVE-2026-13002Medium
A flow in the dnssec.c library causes an infinite loop in the dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.
Original NVD description (English source)
A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.