CVE-2026-5172

Executive Summary

CVE-2026-5172 is a buffer overflow vulnerability residing in dnsmasq’s extract_addresses() function, triggered by parsing malformed DNS responses. The flaw permits a heap out-of-bounds read via the extract_name() function, which can advance a memory pointer beyond the end of the DNS record, leading to a crash (denial of service) and potentially enabling limited information disclosure or integrity compromise. The vulnerability is remotely exploitable over the network without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and while no public exploit or PoC exists at this time, an EPSS percentile of 84.9% indicates elevated threat-actors interest relative to other CVEs. A confirmed patch is available based on multiple authoritative sources, but specific version numbers are not stated in the provided data.

Technical Analysis

The vulnerability is classified under CWE-125 (Out-of-bounds Read) and originates in dnsmasq’s DNS response handling logic. Specifically, the flaw is in the extract_addresses() function, which parses DNS resource records from responses received by dnsmasq (typically operating as a caching DNS forwarder or DHCP server). When dnsmasq processes a DNS response—for example, one that includes answer records, additional records, or authority sections—it calls extract_name() to decode domain names embedded within those records.

The defect is a classic heap out-of-bounds read condition: extract_name() lacks a sufficient bounds check to ensure the pointer it advances remains within the allocated buffer for the DNS message or individual record. By crafting a DNS response with a deliberately malformed record—such as one with compression pointers that loop or point past the end of the record, or a name field that claims an impossible length—an attacker can cause extract_name() to read beyond the end of the record’s buffer. Because the overflow occurs in a heap-allocated region (the buffer holding the DNS response), this could lead to a read of adjacent heap memory.

The technical mechanism does not involve code execution; the CWE-125 classification confirms this is a read-based flaw, not a write-based buffer overflow. The impact is primarily a crash (denial of service) due to the out-of-bounds read potentially triggering a segmentation fault or assertion failure in dnsmasq’s memory allocator. The CVSS vector also indicates a low-level confidentiality (C:L) and integrity (I:L) impact — the out-of-bounds read may leak heap memory contents in certain logging or error paths, and the malformed data could be echoed back in a way that subtly corrupts internal state. Availability impact is rated low (A:L), meaning a single crash does not necessarily take down all DNS services, though repeated exploitation could cause persistent service disruption.

The attack surface is specifically the DNS response parsing path. This means the vulnerable function is reachable when dnsmasq acts as a forwarder (receiving responses from upstream DNS servers) or when it processes responses in other modes. For the vulnerability to be exploitable, an attacker must be able to inject a malicious DNS response that dnsmasq will parse. In a typical deployment, this would involve: (1) running a rogue upstream DNS server, or (2) performing DNS cache poisoning / spoofing to deliver a crafted response to dnsmasq. The CVSS vector confirms the attack is network-based (AV:N) and requires no privileges (PR:N) or user interaction (UI:N).

Exploitation Scenarios

No public PoC or exploit code is currently available. The attack chain below is inferred from the vulnerability class (heap out-of-bounds read in a DNS parser) and the provided NVD description.

Step 1 — Reconnaissance / Target Identification. An attacker identifies dnsmasq instances exposed to the network. This is commonly accomplished via internet-wide scanning for UDP/TCP port 53 services that respond to DNS queries and exhibit dnsmasq-specific behavior (e.g., version string in responses or distinct handling of certain record types). Targets include edge routers, IoT gateways, small-office home-office (SOHO) firewalls, and enterprise DNS forwarders running unpatched versions.

Step 2 — Triggering the Flaw. The attacker must cause dnsmasq to parse a malicious DNS response. Two primary vectors exist:

• Rogue upstream server: The attacker configures or controls a malicious DNS server and manipulates a victim dnsmasq instance into forwarding queries to it (e.g., via DHCP-supplied DNS settings in untrusted network segments).
• DNS spoofing/cache poisoning: The attacker sends a crafted DNS response directly to the victim dnsmasq instance, spoofing the source IP of a legitimate upstream server and predicting the transaction ID and source port to successfully poison the cache or pass the response-processing checks.

The malicious response contains one or more DNS records in which the name field is deliberately malformed — for example, a compression pointer that references an offset beyond the actual record’s data, or a label length byte that declares a string longer than the remaining buffer space. When dnsmasq’s extract_addresses() function iterates over these records and calls extract_name(), the latter function advances a pointer past the end of the record’s allocated heap buffer.

Step 3 — Payload / Execution Method. No code injection is involved. The payload is the malformed DNS response itself, designed to trigger the heap out-of-bounds read in extract_name(). The attacker’s goal is to force the pointer to walk off the heap chunk boundary, causing the read to access adjacent heap metadata or unmapped memory, which typically crashes the dnsmasq process with a SIGSEGV or triggers an allocator assertion.

Step 4 — Post-Exploitation Impact. The primary post-exploitation impact is denial of service — a single malformed response can crash the dnsmasq service. For enterprise environments where dnsmasq is the primary DNS resolver for internal networks, this can result in DNS resolution failures across the entire subnet, breaking name resolution for all dependent services (e.g., web traffic, email, internal application lookups). An attacker could repeatedly send malformed responses to maintain a persistent denial-of-service state. Given the C:L and I:L CVSS sub-scores, there is also a theoretical possibility that the out-of-bounds read could leak fragments of heap memory in debug/log output or otherwise corrupt dnsmasq’s internal state, but these secondary impacts are not confirmed by available evidence and should be treated as lower-probability effects.

Impact Assessment

Business Impact. The vulnerability enables remote, unauthenticated denial of service against dnsmasq instances. For organizations relying on dnsmasq for DHCP and DNS forwarding in network appliances (SOHO routers, enterprise edge devices, virtualized network functions), exploitation could interrupt essential network services. Because dnsmasq is often deployed in embedded devices and headless gateways, a crash may not automatically trigger a restart, leaving the device’s DNS and DHCP functions offline until manual intervention or a watchdog reboot. This can directly impact end-user connectivity, device provisioning, and dependent automation that relies on DNS resolution.

Affected Systems. dnsmasq installations that process DNS responses from untrusted sources are affected. This includes any dnsmasq configuration that forwards queries to an upstream resolver over an unauthenticated channel (standard DNS over UDP/TCP). DHCP-only deployments (no DNS forwarding) would be at lower risk unless they also handle DNS responses for other purposes.

Blast Radius. The CVSS subscores are: Confidentiality (L), Integrity (L), Availability (L), all rated at the low end of the scale. The aggregate score of 7.3 (High) reflects that the vulnerability is trivially exploitable remotely (AV:N/AC:L/PR:N/UI:N) but that each impact component is relatively limited. In practice, the most significant real-world consequence is availability degradation through service crashes, which could be sustained if the attacker re-exploits the flaw repeatedly. The limited confidentiality and integrity impact suggest that adjacent heap memory disclosure is possible but not likely to expose sensitive credentials or allow data modification in typical deployments. The 84.9% EPSS percentile indicates that this CVE is more likely to be exploited in the wild than 84.9% of other published vulnerabilities, underscoring the importance of timely patching.

Detection Guidance

Sigma Rule

title: Suspicious DNS Response Causing dnsmasq Crash
id: 5b1f46e3-8c81-4d2e-a8c9-123456789abc
status: experimental
description: Detects repeated dnsmasq service crashes or abnormal restarts following malformed DNS responses, indicative of CVE-2026-5172 exploitation attempts.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/dnsmasq'
  condition: selection
fields:
  - process.name
  - process.command_line
falsepositives:
  - Legitimate dnsmasq crashes due to configuration errors
level: medium

YARA Rule

/*
 * YARA rule to detect network captures or memory dumps containing
 * dnsmasq DNS response parsing artifacts associated with CVE-2026-5172.
 * Heuristic-based: flags DNS records with suspicious compression pointer
 * offsets exceeding the record boundary.
 */
rule CVE_2026_5172_DNS_Compression_Pointer_Anomaly
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects DNS response packets with compression pointer values that could trigger heap OOB read in dnsmasq extract_addresses()"
        cve = "CVE-2026-5172"
        date = "2026-06-01"

    strings:
        // DNS header with QDCOUNT > 0 (standard query response)
        $dns_flags = { 81 80 } // response, no error

        // Common dnsmasq query patterns (version.bind, CHAOS TXT)
        $query_version = "version.bind" ascii nocase
        $query_server = "server.bind" ascii nocase

    condition:
        uint16(0) == 0 // placeholder for pcap context, actual rule should have a "filesize" or context check
        and $dns_flags
        and any of them
}

Suricata IDS Rule

alert udp any any -> any 53 (msg:"CVE-2026-5172 Attempt - dnsmasq Heap OOB Read via Malformed DNS Response"; flow:to_server; dns_query; content:"|81 80|"; depth:2; offset:2; content:"|00 01|"; distance:2; within:4; content:"|00 00|"; distance:2; within:4; content:"|00 00|"; distance:2; within:4; reference:cve,2026-5172; classtype:attempted-dos; sid:2026005172; rev:1;)

Elastic Detection

// EQL rule for Elasticsearch SIEM - dnsmasq crash detection
process where event.type == "start" and process.name == "dnsmasq" and process.exit_code != 0 and process.parent.name != "systemd"

Splunk SPL Query

index=_internal sourcetype=syslog OR sourcetype=syslogd (message="*dnsmasq*crash*" OR message="*dnsmasq*segfault*" OR message="*dnsmasq*fatal*") | rex field=message ".*dnsmasq.*" | stats count by host, source, _time | where count > 3

Wazuh OSSEC Rule

<group name="dnsmasq,">
  <rule id="1005172" level="7">
    <decoded_as>syslog</decoded_as>
    <match>dnsmasq</match>
    <regex>crash|fatal|segfault</regex>
    <description>CVE-2026-5172: dnsmasq crash suspected from malformed DNS response</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>attack.dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 4/4 — CONFIRMED. Multiple independent sources (NVD, CNA, OSV, Debian, RHSA) verify that a fix exists. However, the specific fixed version numbers and vendor patch references are not provided in the available data.

1. Immediate Mitigations

   • If a vendor patch is available from the relevant distribution or upstream project, apply it immediately. Given the confirmed fix status, upgrading dnsmasq to the latest patched version should be the first priority.
   • Restrict DNS forwarding to trusted upstream servers only. If dnsmasq is used in an environment where upstream DNS servers could be untrusted (e.g., public Wi-Fi, guest networks), reconfigure to use only vetted, internal resolvers.
   • If dnsmasq is not essential for DNS forwarding (i.e., used only for DHCP), consider disabling the DNS forwarding feature entirely to eliminate the attack surface.
   • Employ network-level protections: configure firewalls to allow inbound DNS queries only from authorized clients, and use UDP source port randomization in dnsmasq to reduce DNS spoofing risk (if not already enabled).

2. Patch / Upgrade Steps

   • Check the version of dnsmasq running on affected systems (dnsmasq --version).
   • Consult the specific Linux distribution’s advisory (Debian, Red Hat) for the patched dnsmasq package version and update via the native package manager: apt update && apt upgrade dnsmasq or yum update dnsmasq.
   • For embedded devices or appliances that bundle dnsmasq, obtain firmware updates from the device vendor.
   • After upgrading, restart the dnsmasq service and verify it is operational. Confirm the patched version number matches the advisory’s fixed version.

3. Long-Term Hardening

   • Implement DNS-over-TLS or DNS-over-HTTPS forwarding where supported to reduce the feasibility of on-path response spoofing.
   • Segment DNS infrastructure from general client networks to limit exposure of internal dnsmasq instances to external attackers.
   • Enable centralized logging for dnsmasq and integrate with a SIEM to detect crash patterns that may indicate exploitation attempts.
   • Subscribe to vendor security advisories for dnsmasq (and the relevant distribution channels) to ensure timely awareness of future vulnerabilities.
   • For critical infrastructure, consider deploying redundant DNS resolvers to maintain availability during a dnsmasq crash or remediation window.

References

1. NVD Entry for CVE-2026-5172 — https://nvd.nist.gov/vuln/detail/CVE-2026-5172
2. CNA Advisory for CVE-2026-5172 (via CVE.org) — https://www.cve.org/CVERecord?id=CVE-2026-5172
3. Debian Security Tracker — https://security-tracker.debian.org/tracker/CVE-2026-5172
4. Red Hat Security Advisory (RHSA) — https://access.redhat.com/security/cve/CVE-2026-5172

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public exploit code, PoC, or evidence of exploitation in the wild is reported. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.02683 (84.9th percentile) indicates moderate-to-high interest among threat actors, likely due to the low complexity of exploitation and the prevalence of dnsmasq in internet-facing devices, but actual weaponization has not yet been observed.