CVE-2026-112274 in libtins
Summary
by MITRE • 10/19/2026
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in libtins versions up through 4.6 represents a critical memory safety flaw within the DNS module, specifically affecting the initialization logic for Start of Authority records. This out-of-bounds read issue stems from an improper handling of string termination when processing raw SOA Resource Data. The core technical defect lies in the soa_record::init function, which relies on standard C-style string operations without adequately verifying that input buffers are properly null-terminated before performing length calculations. When an application utilizes the buffer constructor to feed raw SOA RDATA into this routine, the library assumes the presence of a terminating zero byte at the end of the data stream. This assumption is not validated against the actual contents provided by the attacker or malformed source.
In practice, when an input lacks the required NUL terminator, the strlen function invoked during initialization continues reading memory beyond the allocated heap buffer boundaries to locate the missing null character. This behavior constitutes a classic out-of-bounds read vulnerability, categorized under CWE-125 in industry standards for improper limit enforcement on array reads. The operational impact of this flaw is significant as it allows remote attackers to potentially leak sensitive information from adjacent memory regions that may contain stack canaries, pointers, or other confidential data belonging to the application process. Furthermore, if the search for a NUL byte leads into unmapped memory pages, the result is an immediate segmentation fault, leading to a denial of service condition where the affected application crashes unexpectedly.
This vulnerability aligns with ATT&CK technique T1059, specifically regarding command and script interpretation contexts where malformed inputs are used to trigger unintended execution paths or system instability. The exploitation vector typically involves sending crafted DNS packets containing SOA records with deliberately omitted trailing zeros. Security practitioners should note that this issue highlights the dangers of trusting external data formats without rigorous validation in network-facing libraries. Mitigation strategies primarily involve upgrading libtins to a version later than 4.6, where developers have implemented bounds checking and explicit length parameters for string operations instead of relying solely on null-termination assumptions. Additionally, defensive coding practices such as using safe string functions that accept buffer size limits or implementing strict input validation at the network packet parsing layer can prevent similar issues in other components of a software stack.