dnsmasq up to 2.73rc6 Config File src/util.c parse_hex i heap-based overflow ⚔ [Disputed]

Summaryinfo

A vulnerability classified as critical was found in dnsmasq up to 2.73rc6. Affected by this vulnerability is the function parse_hex of the file src/util.c of the component Config File Handler. The manipulation of the argument i results in heap-based overflow. This vulnerability was named CVE-2025-12198. The attack needs to be approached locally. In addition, an exploit is available. It is still unclear if this vulnerability genuinely exists. Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability classified as critical has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of the file src/util.c of the component Config File Handler. The manipulation of the argument i with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared for download at shimo.im. This vulnerability is traded as CVE-2025-12198. The exploitability is told to be easy. The attack needs to be approached locally. Technical details and a public exploit are known. dnsmasq might be started as root, but not everybody interacting with dnsmasq might be or shall remain root. For example if dnsmask is configured or used via a web frontend which shall limit the capabilities of influence. If in this case a malicious dnsmasq admin is able to execute arbitrary code, this might allow for unwanted escalation of capabilities.

The exploit is shared for download at shimo.im. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about this disclosure but did not respond in any way. Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities. The vulnerability scanner Nessus provides a plugin with the ID 276816 (Linux Distros Unpatched Vulnerability : CVE-2025-12198 (deprecated)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (276816) and EUVD (EUVD-2025-36061). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Domain Name Software

Name

• dnsmasq

Version

• 2.73rc1
• 2.73rc2
• 2.73rc3
• 2.73rc4
• 2.73rc5
• 2.73rc6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #673138: dnsmasq dnsmasq v2.73rc6 Heap-based Buffer Overflow (by zh_vul)

Once again VulDB remains the best source for vulnerability data.

Discussion