CVE-2026-112273 in libtins
Summary
by MITRE • 10/19/2026
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in libtins versions up to 4.6 represents a critical heap-based out-of-bounds read flaw located within the DNS::compose_name function found in src/dns.cpp. This specific defect arises from an improper boundary check during the parsing of Domain Name System packets, where the library fails to correctly validate whether a label ends precisely at the limit of the allocated packet buffer. When a remote attacker crafts and transmits a maliciously constructed DNS packet containing labels that terminate exactly at the end of the data segment, the parser attempts to read beyond the valid memory boundaries. This behavior is characteristic of CWE-125, which describes out-of-bounds read vulnerabilities where software reads past the intended buffer, potentially accessing sensitive information or causing instability in the application environment.
The operational impact of this vulnerability extends beyond simple data leakage due to its potential for denial of service through application crashes. Because libtins is often utilized within network analysis tools and security applications that handle untrusted traffic from various sources, an attacker can exploit this flaw by delivering crafted DNS packets with additional, answer, or authority records designed to trigger the erroneous one-byte read operation. On systems employing hardened memory allocators such as glibc's tcache or ASLR-enabled environments, attempting to access invalid heap addresses typically results in immediate termination of the process via segmentation faults or similar fatal errors. This effectively allows remote attackers to disrupt service availability by causing crashes in any application that integrates libtins for packet parsing without implementing additional input sanitization layers.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1498.002, Network Denial of Service via Resource Exhaustion, as the exploitation leads to service disruption through process termination rather than resource consumption in the traditional sense. The attack vector is classified under Remote Code Execution prerequisites for availability impact, specifically leveraging network-based delivery mechanisms common in DNS traffic interception or spoofing scenarios. Security practitioners must recognize that while this specific flaw may not directly lead to arbitrary code execution due to the read-only nature of the out-of-bounds access, it serves as a reliable method for destabilizing security monitoring infrastructure and packet inspection systems that rely on libtins for deep packet analysis.
Mitigation strategies should prioritize immediate upgrading to patched versions of libtins released after version 4.6, where developers have addressed the boundary validation logic within the compose_name function. In environments where updating is not immediately feasible, network-level filtering rules can be implemented to inspect and drop DNS packets with anomalous label structures or excessive record counts that might trigger this parsing error. Additionally, deploying intrusion detection signatures capable of identifying malformed DNS queries targeting known vulnerable parsers can provide a layer of defense against exploitation attempts. Continuous monitoring for abnormal process terminations in applications linked against libtins is also recommended to detect potential active exploitation attempts in real-time.