Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HArista Eos
OSArista≤ 4.154.18 – 4.18.4.2f4.17 – 4.17.8m (excl.)4.16 – 4.16.13m (excl.)Arubanetworks Arubaos
OSArubanetworks6.3.1 – 6.3.1.25 (excl.)8.1.0.0 – 8.1.0.4 (excl.)6.5.4.0 – 6.5.4.2 (excl.)6.5.3.0 – 6.5.3.3 (excl.)6.5.0.0 – 6.5.1.9 (excl.)6.4.4.0 – 6.4.4.16 (excl.)Canonical Ubuntu
OSCanonical12.0414.0416.0417.04Debian
OSDebian7.07.18.09.0Huawei Honor V9 Play
HWHuaweiall versionsHuawei Honor V9 Play Firmware
OSHuawei< jimmy-al00ac00b135Microsoft Windows
OSMicrosoftall versionsNvidia Geforce Experience
APPNvidia3.0 – 3.10.0.55 (excl.)Nvidia Jetson Tk1
HWNvidiaall versionsNvidia Jetson Tx1
HWNvidiaall versionsNvidia Linux For Tegra
OSNvidia< r24.2.2< r21.6Opensuse Leap
OSOpensuse42.242.3Red Hat Enterprise Linux Desktop
OSRedhat6.07.0Red Hat Enterprise Linux Server
OSRedhat6.07.0Red Hat Enterprise Linux Workstation
OSRedhat6.07.0Siemens Ruggedcom Rm1224
HWSiemensall versionsSiemens Ruggedcom Rm1224 Firmware
OSSiemens< 5.0Siemens Scalance M 800
HWSiemensall versionsSiemens Scalance M 800 Firmware
OSSiemens< 5.0Siemens Scalance S615
HWSiemensall versionsSiemens Scalance S615 Firmware
OSSiemens< 5.0Siemens Scalance W1750d
HWSiemensall versionsSiemens Scalance W1750d Firmware
OSSiemens< 6.5.1.5SUSE Linux Enterprise Debuginfo
APPSuse11SUSE Linux Enterprise Point Of Sale
APPSuse11SUSE Linux Enterprise Server
OSSuse1112Synology Diskstation Manager
OSSynology5.26.06.1Synology Router Manager
APPSynology1.1Thekelleys Dnsmasq
APPThekelleys≤ 2.77
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEDoSMemory
CWE
References
Related vulnerabilities
CVE-2026-8398CRITICAL9.3⚠ KEVPL ✓same product
Atak na łańcuch dostaw DAEMON Tools Lite — trojanizacja instalatorów
CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓same product
GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER
CVE-2025-10585CRITICAL9.8⚠ KEVPL ✓same product
Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty
CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product
Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)
CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓same product
RCE przez deserializację PHP w Roundcube Webmail (parametr _from)