dnsmasq NXDOMAIN src/rfc1035.c find_soa out-of-bounds

Summaryinfo

A vulnerability was found in dnsmasq and classified as problematic. This affects the function find_soa of the file src/rfc1035.c of the component NXDOMAIN Handler. Such manipulation leads to out-of-bounds. This vulnerability is listed as CVE-2026-12969. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in dnsmasq (the affected version is unknown). Affected by this issue is the function find_soa of the file src/rfc1035.c of the component NXDOMAIN Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. CVE summarizes:

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-12969 since 06/23/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 322302 (Linux Distros Unpatched Vulnerability : CVE-2026-12969), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (322302). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Domain Name Software

Name

• dnsmasq

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion