VDB
DEBIAN-CVE-2026-5172
DEBIAN-CVE-2026-5172
PUBLISHED
CVSS 7.300000190734863 HIGH
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | dnsmasq | 0, 2.91-1 |
| Debian:12 | dnsmasq | 0, 2.89-1, 2.90-1 |
| Debian:14 | dnsmasq | 0, 2.91-1, 2.92-1 |
| Debian:11 | dnsmasq | 2.91-1, 2.91, 2.91 |
Timeline
- May 11, 2026 CVE Published
- May 14, 2026 CVE Updated