CVE-2026-85234 in tftp-hpa
Summary
by MITRE • 09/15/2026
A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The tftp-hpa package provides an implementation of the Trivial File Transfer Protocol server, commonly used for booting diskless workstations or transferring configuration files in networked environments. The core component, in.tftpd, handles incoming TFTP requests and manages file transfers based on configured rules. A critical security flaw exists within the remap engine responsible for processing inverse remapping rules. This engine is designed to translate requested filenames into actual filesystem paths while applying access controls and path restrictions. However, when an inverse remap rule includes a custom error message that triggers an abort condition during validation, the internal logic fails to correctly calculate or validate match offsets before passing them to the genmatchstring function.
This technical flaw results in invalid memory addresses being passed to string generation routines within the daemon process. Specifically, the miscalculated offsets lead to out-of-bounds read and write operations against the heap or stack memory of the tftpd process. The vulnerability stems from insufficient bounds checking during the parsing and execution phase of complex remap rules that combine pattern matching with error handling mechanisms. Because TFTP is a stateless protocol often used in automated deployment scenarios, attackers can interact with this service without requiring authentication credentials, making it particularly susceptible to remote exploitation attempts by any entity capable of reaching the network segment hosting the tftpd daemon.
The operational impact of exploiting this vulnerability centers on denial of service conditions. By sending specially crafted TFTP requests that trigger the flawed remap logic, an attacker can cause the in.tftpd process to crash due to memory corruption errors such as segmentation faults or illegal instruction exceptions. In environments where tftp-hpa is running continuously for network boot services like PXE, this disruption prevents legitimate clients from obtaining operating system images or configuration files, effectively halting automated deployment workflows. While the primary confirmed impact is a service outage, out-of-bounds memory access vulnerabilities inherently carry risks of information disclosure if crash dumps are generated and accessible to local users with sufficient privileges.
This vulnerability aligns with CWE-125, which describes Out-of-Bounds Read, as well as CWE-787, representing Out-of-Bounds Write, depending on the specific execution path triggered by the malformed request. From a threat modeling perspective consistent with MITRE ATT&CK techniques, this flaw facilitates Remote Service Exploitation and potentially Denial of Service against network services. Attackers may leverage such vulnerabilities to disrupt critical infrastructure components that rely on reliable file transfer mechanisms for system provisioning or maintenance tasks.
Mitigation strategies primarily involve updating the tftp-hpa package to a version where the remap engine logic has been patched to properly validate match offsets before invoking string generation functions. System administrators should verify their current software versions against vendor advisories and apply security patches promptly. In cases where immediate patching is not feasible, deploying network-level access control lists to restrict TFTP traffic to trusted IP ranges can reduce the attack surface significantly since the vulnerability requires remote unauthenticated access. Additionally disabling unnecessary remap rules or simplifying complex configuration entries may mitigate exposure until a permanent fix is implemented. Regular monitoring of system logs for unexpected daemon restarts or core dumps associated with tftpd processes serves as an effective detection mechanism for potential exploitation attempts in production environments.